All checks
Medium
Remove unused Secrets Manager secrets
Checks that a Secrets Manager secret has been retrieved in this Region within 90 days, AWS's default period. An unused secret can still be used by people who no longer need it, so deleting it revokes that access. A secret never retrieved is judged by the time since it was created.
- service
- SecretsManager
- severity
- Medium
- scope
- evaluated in every region
How to fix it
- Can break clients: The secret cannot be retrieved from the moment it is deleted, so anything still using it fails at once; restore-secret undoes this during the waiting period.
- Can't be undone: When the waiting period ends the secret and all of its versions are deleted permanently.
In the console
Secrets Manager → Secrets → the secret → Secret details → Actions
- Delete secret
- Once nothing retrieves the secret any more
- Waiting period
- 7 to 30 days, the time in which the deletion can still be cancelled
With the AWS CLI
aws secretsmanager delete-secret --secret-id <secret-name> --recovery-window-in-days 30 --region <region>See which of your accounts this check is failing on.
Book a live scan