AWS Secrets Manager Secret Rotation
This page shows how to write Terraform and CloudFormation for Secrets Manager Secret Rotation and write them securely.
aws_secretsmanager_secret_rotation (Terraform)
The Secret Rotation in Secrets Manager can be configured in Terraform with the resource name aws_secretsmanager_secret_rotation. The following sections describe 5 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "aws_secretsmanager_secret_rotation" "auth" {
secret_id = aws_secretsmanager_secret.auth.id
rotation_lambda_arn = aws_lambda_function.lambda.arn
rotation_rules {
automatically_after_days = 30
resource "aws_secretsmanager_secret_rotation" "auth" {
secret_id = aws_secretsmanager_secret.auth.id
rotation_lambda_arn = aws_lambda_function.lambda.arn
rotation_rules {
automatically_after_days = 30
resource "aws_secretsmanager_secret_rotation" "example" {
count = var.enabled_rotation_secret ? 1 : 0
secret_id = aws_secretsmanager_secret.secret.id
rotation_lambda_arn = var.rotation_lambda_arn
rotation_rules {
resource "aws_secretsmanager_secret_rotation" "rotation_lambda" {
secret_id = aws_secretsmanager_secret.sco-rds-master.id
rotation_lambda_arn = aws_lambda_function.rotation_lambda.arn
rotation_rules {
automatically_after_days = 30
resource "aws_secretsmanager_secret_rotation" "secretsmanager_secret_rotation" {
count = var.enable_secretsmanager_secret_rotation ? 1 : 0
secret_id = var.secretsmanager_secret_rotation_secret_id != "" && !var.enable_secretsmanager_secret ? var.secretsmanager_secret_rotation_secret_id : (var.enable_secretsmanager_secret ? element(aws_secretsmanager_secret.secretsmanager_secret.*.id, 0) : null)
rotation_lambda_arn = var.secretsmanager_secret_rotation_rotation_lambda_arn
Parameters
-
idoptional computed - string -
rotation_enabledoptional computed - bool -
rotation_lambda_arnrequired - string -
secret_idrequired - string -
tagsoptional - map from string to string -
rotation_ruleslist block-
automatically_after_daysrequired - number
-
Explanation in Terraform Registry
Provides a resource to manage AWS Secrets Manager secret rotation. To manage a secret, see the
aws_secretsmanager_secretresource. To manage a secret value, see theaws_secretsmanager_secret_versionresource.
AWS::SecretsManager::RotationSchedule (CloudFormation)
The RotationSchedule in SecretsManager can be configured in CloudFormation with the resource name AWS::SecretsManager::RotationSchedule. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
An example could not be found in GitHub.
Parameters
-
SecretIdrequired - String -
HostedRotationLambdaoptional - HostedRotationLambda -
RotationLambdaARNoptional - String -
RotationRulesoptional - RotationRules
Explanation in CloudFormation Registry
Configures rotation for a secret. You must already configure the secret with the details of the database or service. If you define both the secret and the database or service in an AWS CloudFormation template, then define the AWS::SecretsManager::SecretTargetAttachment resource to populate the secret with the connection details of the database or service before you attempt to configure rotation.
Important When you configure rotation for a secret, AWS CloudFormation automatically rotates the secret one time.
Frequently asked questions
What is AWS Secrets Manager Secret Rotation?
AWS Secrets Manager Secret Rotation is a resource for Secrets Manager of Amazon Web Service. Settings can be wrote in Terraform and CloudFormation.
Where can I find the example code for the AWS Secrets Manager Secret Rotation?
For Terraform, the gh-rbalimidi/samba_lambda_apigateway, gh-rbalimidi/terraform and OT-CLOUD-KIT/terraform-aws-secret-manager source code examples are useful. See the Terraform Example section for further details.
