Secrets Manager Secrets Should Be Rotated Frequently
More Info:
Ensure that the rotation interval for your AWS Secrets Manager secrets is configured to meet security and compliance requirements. Prior to running this rule by the Cloud Conformity engine, the rotation interval (in days) must be configured in the rule settings, on your Cloud Conformity account dashboard. Amazon Secrets Manager rotation feature represents the automatic process that periodically change your secrets information to make it more difficult for attackers to access the services and resources secured with these secrets.Risk Level
MediumAddress
SecurityCompliance Standards
HITRUST, AWSWAF, PCIDSS, ISO27001Triage and Remediation
Remediation
Using Console
Using Console
To remediate the issue of Secrets Manager secrets not being rotated frequently in AWS using the AWS console, follow these steps:
- Open the AWS Secrets Manager console.
- Select the secret that needs to be rotated.
- Click on the “Rotation” tab.
- Click on the “Edit rotation” button.
- In the “Configure rotation” section, select the rotation frequency and the number of days to keep the previous version of the secret.
- Click on the “Enable rotation” checkbox.
- Choose the Lambda function or AWS Secrets Manager to rotate the secret.
- Click on the “Save changes” button.
Using CLI
Using CLI
To remediate the misconfiguration of Secrets Manager Secrets not being rotated frequently in AWS using AWS CLI, follow these steps:Note: Replace Note: Replace
- Open the AWS CLI on your local machine.
- Run the following command to list all the secrets available in the Secrets Manager service:
- Identify the secret that needs to be rotated frequently.
- Run the following command to rotate the secret:
<secret-id> with the ID of the secret that needs to be rotated.- After running the above command, the Secrets Manager service will create a new version of the secret and update the old version with a new password or other credentials.
- Update the applications or services that use the secret with the new credentials.
- Delete the old version of the secret using the following command:
<secret-id> with the ID of the old version of the secret.- Repeat the above steps periodically to ensure that secrets are rotated frequently. It is recommended to set up automated rotation using AWS Lambda or other automation tools.
Using Python
Using Python
To remediate the issue of Secrets Manager Secrets not being rotated frequently in AWS, you can use the following steps using Python:
- Import the Boto3 library for AWS:
- Create an AWS Secrets Manager client:
- Get a list of all secrets in AWS Secrets Manager:
- Loop through the list of secrets and check if each secret has been rotated within the last 30 days:
- If a secret has not been rotated within the last 30 days, use the
rotate_secretfunction to rotate the secret:
- Add logging and error handling to the script as needed.
- Schedule the script to run on a regular basis (e.g. daily) using AWS Lambda or a cron job.