> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Secret rotation interval remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the issue of Secrets Manager secrets not being rotated frequently in AWS using the AWS console, follow these steps:

        1. Open the AWS Secrets Manager console.
        2. Select the secret that needs to be rotated.
        3. Click on the "Rotation" tab.
        4. Click on the "Edit rotation" button.
        5. In the "Configure rotation" section, select the rotation frequency and the number of days to keep the previous version of the secret.
        6. Click on the "Enable rotation" checkbox.
        7. Choose the Lambda function or AWS Secrets Manager to rotate the secret.
        8. Click on the "Save changes" button.

        By following these steps, the Secrets Manager secret will be automatically rotated according to the selected frequency, and the previous versions of the secret will be kept for the specified number of days.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of Secrets Manager Secrets not being rotated frequently in AWS using AWS CLI, follow these steps:

        1. Open the AWS CLI on your local machine.

        2. Run the following command to list all the secrets available in the Secrets Manager service:

        ```
        aws secretsmanager list-secrets
        ```

        3. Identify the secret that needs to be rotated frequently.

        4. Run the following command to rotate the secret:

        ```
        aws secretsmanager rotate-secret --secret-id <secret-id>
        ```

        Note: Replace `<secret-id>` with the ID of the secret that needs to be rotated.

        5. After running the above command, the Secrets Manager service will create a new version of the secret and update the old version with a new password or other credentials.

        6. Update the applications or services that use the secret with the new credentials.

        7. Delete the old version of the secret using the following command:

        ```
        aws secretsmanager delete-secret --secret-id <secret-id> --force-delete-without-recovery
        ```

        Note: Replace `<secret-id>` with the ID of the old version of the secret.

        8. Repeat the above steps periodically to ensure that secrets are rotated frequently. It is recommended to set up automated rotation using AWS Lambda or other automation tools.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the issue of Secrets Manager Secrets not being rotated frequently in AWS, you can use the following steps using Python:

        1. Import the Boto3 library for AWS:

        ```python theme={null}
        import boto3
        ```

        2. Create an AWS Secrets Manager client:

        ```python theme={null}
        client = boto3.client('secretsmanager')
        ```

        3. Get a list of all secrets in AWS Secrets Manager:

        ```python theme={null}
        secrets = client.list_secrets()
        ```

        4. Loop through the list of secrets and check if each secret has been rotated within the last 30 days:

        ```python theme={null}
        for secret in secrets['SecretList']:
            if 'RotationRules' in secret:
                rotation_days = secret['RotationRules']['AutomaticallyAfterDays']
                last_rotated_date = secret['LastRotatedDate']
                if (datetime.now() - last_rotated_date).days > rotation_days:
                    # Secret has not been rotated within the last 30 days
                    # Code to rotate the secret goes here
        ```

        5. If a secret has not been rotated within the last 30 days, use the `rotate_secret` function to rotate the secret:

        ```python theme={null}
        client.rotate_secret(SecretId=secret['ARN'])
        ```

        6. Add logging and error handling to the script as needed.

        7. Schedule the script to run on a regular basis (e.g. daily) using AWS Lambda or a cron job.

        By following these steps, you can ensure that all secrets in AWS Secrets Manager are rotated frequently, which helps to improve the security of your AWS environment.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_secretsmanager_secret" "this" {
          name        = "SECRET_NAME"        # replace with your secret name
          description = "SECRET_DESCRIPTION" # replace with your description
        }

        # Enable or configure automatic rotation for the secret using a Lambda function
        resource "aws_secretsmanager_secret_rotation" "this" {
          secret_id           = aws_secretsmanager_secret.this.id
          rotation_lambda_arn = "ROTATION_LAMBDA_ARN" # replace with the ARN of your rotation Lambda

          rotation_rules {
            automatically_after_days = 90 # adjust to meet your organization's policy
          }
        }
        ```

        This requires that `ROTATION_LAMBDA_ARN` already exists and has the correct IAM permissions for rotation; Terraform will fail to apply if the Lambda cannot be invoked by Secrets Manager. This configuration is update-in-place and does not force replacement of the secret.

        Verification: `terraform plan` should show creation (or update) of `aws_secretsmanager_secret_rotation.this` with `rotation_lambda_arn = "ROTATION_LAMBDA_ARN"` and `rotation_rules.0.automatically_after_days = 90`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>