Secret Manager Secrets Rotation Enabled
More Info:
Ensure that AWS Secrets Manager service is configured to automatically rotate your service or database secrets (i.e. enable automatic rotation feature for your secrets). Secrets Manager rotation is the automatic process that periodically change your secrets data to make it more difficult for an attacker to access the services and resources secured with these secrets. With Amazon Secrets Manager you don’t have to manually change the secret and update it on all of your clients. Instead, the Secrets Manager service uses an AWS Lambda function to perform for you all of the steps required for rotation, on a regular schedule (predefined or custom).Risk Level
MediumAddress
SecurityCompliance Standards
ISO27001, AWSWAF, SOC2, NISTCSFTriage and Remediation
Remediation
Using Console
Using Console
To remediate the “Secret Manager Secrets Rotation Enabled” misconfiguration for AWS using the AWS console, please follow these steps:
- Log in to the AWS Management Console.
- Navigate to the AWS Secrets Manager service from the Services menu.
- Select the secret for which you want to disable rotation.
- Click on the “Disable rotation” button in the “Rotation configuration” section.
- In the confirmation dialog box, click on the “Disable rotation” button to confirm the action.
Using CLI
Using CLI
The AWS Secret Manager is a service that enables you to store and manage secrets such as database credentials, API keys, and other sensitive data. One of the key features of Secret Manager is the ability to rotate secrets automatically, which helps to prevent unauthorized access to sensitive data.If the misconfiguration is “Secret Manager Secrets Rotation Enabled”, it means that secrets rotation is not enabled for the AWS Secret Manager. To remediate this misconfiguration, you can follow these steps using the AWS CLI:Step 1: List all the secrets in the Secret ManagerStep 2: Enable rotation for each secretNote: Replace This command should return the details of the secret, including the rotation configuration.Step 4: Repeat steps 2 and 3 for all the secrets in the Secret ManagerEnabling secret rotation is an important security best practice, and it helps to ensure that sensitive data is protected from unauthorized access.
<SECRET_ID> with the actual ID of the secret.Step 3: Verify that rotation is enabled for the secretUsing Python
Using Python
To remediate the “Secrets Manager Secrets Rotation Enabled” misconfiguration in AWS using Python, follow these steps:
- Open the AWS Management Console and navigate to the AWS Secrets Manager service.
- Identify the secret(s) that have rotation enabled and note their ARN(s).
- Use the AWS SDK for Python (Boto3) to disable rotation for each identified secret. Here’s an example code snippet:
- Repeat step 3 for each identified secret with rotation enabled.
- Verify that rotation is now disabled for each secret by checking their configuration in the AWS Management Console or using the Boto3 SDK.