Secret Rotation Interval

Sign in to the AWS Management Console.

Navigate to AWS Secrets Manager service dashboard at https://console.aws.amazon.com/secretsmanager/.

In the navigation panel, select Secrets.

Choose the Secrets Manager secret that you want to examine, then click on its name (link) to access the resource configuration details.

On the selected secret configuration page, in the Rotation configuration section, check the Rotation Interval configuration attribute value. If the attribute value (i.e. number of days between secret credentials rotation) is different than the one defined within the rule settings, on your TrendAI Vision One™ Cloud Risk Management Dashboard, the rotation interval configuration for the selected Amazon Secrets Manager secret is not compliant.

Repeat step no. 4 and 5 to check the rotation interval for other Secrets Manager secrets, available in the current AWS region.

Change the AWS region from the navigation bar to repeat the audit process for other regions.

Run list-secrets command (OSX/Linux/UNIX) to list the names of all Secrets Manager secrets available within the selected AWS region:

aws secretsmanager list-secrets
	--region us-east-1
	--query 'SecretList[*].Name'

The command output should return the names of the secrets available within the region:

[
    "cc-mysql-db-access-details",
    "cc-backend-api-access-keys"
]

Run describe-secret command (OSX/Linux/UNIX) using the name of the secret that you want to examine as identifier and custom query filters to return the interval (number of days) set for the automatic rotation feature, enabled for the selected AWS Secrets Manager secret:

aws secretsmanager describe-secret
	--region us-east-1
	--secret-id cc-mysql-db-access-details
	--query 'RotationRules.AutomaticallyAfterDays'

The command output should return the rotation interval configured for the selected secret:

90

If the value (i.e. number of days) returned by the describe-secret command output is different than the one defined within the rule settings, on your TrendAI Vision One™ Cloud Risk Management Dashboard, the rotation interval configuration for the selected Amazon Secrets Manager secret is not compliant.

Repeat steps no. 3 and 4 to verify the rotation interval for other Secrets Manager secrets, available within the selected AWS region.

Change the AWS region by updating the --region command parameter value and repeat steps no. 1 – 5 to perform the audit process for other regions.

Sign into your TrendAI Vision One™ account to access Cloud Risk Management, access AWS Secrets Manager Rotation Interval rule settings and copy the value configured for the AWS Secrets Manager rotation interval.

Sign in to AWS Management Console.

Navigate to AWS Secrets Manager service dashboard at https://console.aws.amazon.com/secretsmanager/.

In the navigation panel, select Secrets.

Choose the secret that you want to reconfigure (see Audit section part I to identify the right secret), then click on its name (link) to access the resource details.

On the selected secret configuration page, within Rotation configuration section, click Edit rotation to edit the rotation feature configuration.

Inside Edit rotation configuration dialog box, choose Custom from the Select rotation interval dropdown list and paste the value copied at step no. 1, representing the automatic rotation interval (days) defined within the rule settings. Click Save to apply the changes. Once enabled, the Secrets Manager console should display the following confirmation message: "Your secret <secret-name> has been successfully stored and secret rotation is enabled".

Repeat steps no. 5 – 7 for each Secrets Manager secret that you want to reconfigure with the compliant rotation interval, available in the current AWS region.

Change the AWS region from the navigation bar and repeat the entire process for other regions.

Sign into your TrendAI Vision One™ account to access Cloud Risk Management, access AWS Secrets Manager Rotation Interval rule settings and copy the value configured for the AWS Secrets Manager rotation interval.

Run rotate-secret command (OSX/Linux/UNIX) using the name of the Amazon Secrets Manager secret that you want to reconfigure as identifier (see Audit section part II to identify the right resource), the ARN of the AWS Lambda function that performs the rotation and the number of days between rotation, copied at step no. 1, as value for the AutomaticallyAfterDays parameter, to update the rotation feature configuration, and start the process of rotating the selected secret:

aws secretsmanager rotate-secret
	--region us-east-1
	--secret-id cc-mysql-db-access-details
	--rotation-lambda-arn arn:aws:lambda:us-east-1:123456789012:function:SecretsManager-cc-secret-rotation-function
	--rotation-rules AutomaticallyAfterDays=14

The command output should return the request metadata:

{
				"VersionId": "1234abcd-1234-abcd-1234-abcd1234abcd",
				"Name": "cc-mysql-db-access-details",
				"ARN": "arn:aws:secretsmanager:us-east-1:123456789012:secret:cc-mysql-db-access-details-ABC123"
}

Repeat steps no. 1 – 3 for each Secrets Manager secret that you want to reconfigure with the compliant rotation interval, available in the selected region.

Change the AWS region by updating the --region command parameter value and repeat the entire process for other regions.