> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Secret rotation remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the "Secret Manager Secrets Rotation Enabled" misconfiguration for AWS using the AWS console, please follow these steps:

        1. Log in to the AWS Management Console.
        2. Navigate to the AWS Secrets Manager service from the Services menu.
        3. Select the secret for which you want to disable rotation.
        4. Click on the "Disable rotation" button in the "Rotation configuration" section.
        5. In the confirmation dialog box, click on the "Disable rotation" button to confirm the action.

        Once you have completed these steps, the secret will no longer be set to rotate automatically, and you will need to manually rotate the secret when necessary.

        #
      </Accordion>

      <Accordion title="Using CLI">
        The AWS Secret Manager is a service that enables you to store and manage secrets such as database credentials, API keys, and other sensitive data. One of the key features of Secret Manager is the ability to rotate secrets automatically, which helps to prevent unauthorized access to sensitive data.

        If the misconfiguration is "Secret Manager Secrets Rotation Enabled", it means that secrets rotation is not enabled for the AWS Secret Manager. To remediate this misconfiguration, you can follow these steps using the AWS CLI:

        Step 1: List all the secrets in the Secret Manager

        ```
        aws secretsmanager list-secrets
        ```

        Step 2: Enable rotation for each secret

        ```
        aws secretsmanager rotate-secret --secret-id <SECRET_ID> --rotation-rules '{"AutomaticallyAfterDays": 30}'
        ```

        Note: Replace `<SECRET_ID>` with the actual ID of the secret.

        Step 3: Verify that rotation is enabled for the secret

        ```
        aws secretsmanager describe-secret --secret-id <SECRET_ID>
        ```

        This command should return the details of the secret, including the rotation configuration.

        Step 4: Repeat steps 2 and 3 for all the secrets in the Secret Manager

        Enabling secret rotation is an important security best practice, and it helps to ensure that sensitive data is protected from unauthorized access.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the "Secrets Manager Secrets Rotation Enabled" misconfiguration in AWS using Python, follow these steps:

        1. Open the AWS Management Console and navigate to the AWS Secrets Manager service.

        2. Identify the secret(s) that have rotation enabled and note their ARN(s).

        3. Use the AWS SDK for Python (Boto3) to disable rotation for each identified secret. Here's an example code snippet:

        ```python theme={null}
        import boto3

        # Replace <SECRET_ARN> with the ARN of the secret to remediate
        secret_arn = '<SECRET_ARN>'

        # Create a Secrets Manager client
        client = boto3.client('secretsmanager')

        # Disable rotation for the secret
        response = client.update_secret(
            SecretId=secret_arn,
            RotationLambdaARN='',
            RotationRules={
                'AutomaticallyAfterDays': None
            }
        )

        print(response)
        ```

        4. Repeat step 3 for each identified secret with rotation enabled.

        5. Verify that rotation is now disabled for each secret by checking their configuration in the AWS Management Console or using the Boto3 SDK.

        Note: Disabling rotation for a secret means that it will no longer automatically rotate its credentials. You may need to manually rotate the credentials periodically to maintain security.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Existing secret (example)
        resource "aws_secretsmanager_secret" "MY_SECRET" {
          name = "MY_SECRET_NAME" # replace with your secret name
        }

        # Rotation Lambda (you must implement the actual rotation logic)
        resource "aws_lambda_function" "MY_SECRET_ROTATION_FN" {
          function_name = "MY_SECRET_ROTATION_FUNCTION_NAME" # replace with your function name
          role          = aws_iam_role.MY_SECRET_ROTATION_ROLE.arn
          handler       = "index.lambda_handler"
          runtime       = "python3.12"

          filename         = "PATH_TO_ZIPPED_ROTATION_FUNCTION_CODE.zip" # replace
          source_code_hash = filebase64sha256("PATH_TO_ZIPPED_ROTATION_FUNCTION_CODE.zip")
        }

        # IAM role for the rotation Lambda (must allow access to the secret and target service)
        resource "aws_iam_role" "MY_SECRET_ROTATION_ROLE" {
          name = "MY_SECRET_ROTATION_ROLE_NAME" # replace

          assume_role_policy = data.aws_iam_policy_document.lambda_assume_role_policy.json
        }

        data "aws_iam_policy_document" "lambda_assume_role_policy" {
          statement {
            actions = ["sts:AssumeRole"]

            principals {
              type        = "Service"
              identifiers = ["lambda.amazonaws.com"]
            }
          }
        }

        # Attach policy granting the Lambda permissions it needs (simplified; tighten for production)
        resource "aws_iam_role_policy" "MY_SECRET_ROTATION_POLICY" {
          name = "MY_SECRET_ROTATION_POLICY_NAME" # replace
          role = aws_iam_role.MY_SECRET_ROTATION_ROLE.id

          policy = jsonencode({
            Version = "2012-10-17"
            Statement = [
              {
                Effect   = "Allow"
                Action   = ["secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue", "secretsmanager:UpdateSecretVersionStage"]
                Resource = aws_secretsmanager_secret.MY_SECRET.arn
              },
              # add actions/resources for the target service, e.g. RDS credentials update
            ]
          })
        }

        # Enable automatic rotation for the secret
        resource "aws_secretsmanager_secret_rotation" "MY_SECRET_ROTATION" {
          secret_id           = aws_secretsmanager_secret.MY_SECRET.id
          rotation_lambda_arn = aws_lambda_function.MY_SECRET_ROTATION_FN.arn

          rotation_rules {
            automatically_after_days = 90 # adjust as required by your policy
          }
        }
        ```

        This enables automatic rotation for the Secrets Manager secret via a Lambda function, matching the CLI `rotate-secret` behavior (rotation Lambda ARN plus `AutomaticallyAfterDays = 90`). No existing resources are force-replaced; Terraform should show a new `aws_secretsmanager_secret_rotation` (and any new Lambda/IAM resources you add) in the `terraform plan` as `+ create`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>