Rule: Secrets Manager secrets with automatic rotation must rotate successfully

AWS Foundational Security Best Practices - Rule Description

Troubleshooting Steps

2. 1.

   Check Secrets Manager Rotation Scheduler: Verify that the Secrets Manager rotation scheduler is enabled and properly configured. Ensure that the rotation interval and Lambda function associated with the rotation are correctly set up.

4. 2.

   Check Lambda Function: Review the associated Lambda function responsible for rotating the secret. Ensure that the IAM role associated with the Lambda function has the necessary permissions to rotate the secret. Verify the function's code logic and ensure there are no errors in the implementation.

6. 3.

   Verify Secret Configuration: Validate the configuration of the secret itself. Ensure that the secret is marked for automatic rotation and that the rotation configuration aligns with your desired rotation schedule.

8. 4.

   Inspect Logging and Monitoring: Enable CloudTrail logging for AWS Secrets Manager to capture rotation-related events. Review the CloudTrail logs to identify any potential errors or failures during the rotation process. Additionally, utilize Amazon CloudWatch Logs to monitor the rotation activity and identify any anomalies or issues.

Necessary Codes

import boto3

def enable_secret_rotation(secret_name):
    client = boto3.client("secretsmanager")
    response = client.rotate_secret(SecretId=secret_name)
    return response

secret_name = "your-secret-name"
response = enable_secret_rotation(secret_name)
print(response)

rotate_secret

Step-by-Step Guide for Remediation

2. 1.

   Verify Rotation Scheduler: Confirm that the Secrets Manager rotation scheduler is enabled and properly configured by accessing the AWS Management Console.

   • Open the Secrets Manager console.
   • Select "Secrets" from the left navigation pane.
   • Choose the secret that requires rotation.
   • Ensure that the "Rotation configuration" section is correctly set with the desired rotation options, including interval and rotation Lambda function.
4. 2.

   Validate IAM Role: Ensure that the IAM role associated with the rotation Lambda function has the necessary permissions to interact with Secrets Manager.

   • Open the AWS Identity and Access Management (IAM) console.
   • Navigate to "Roles" from the left navigation pane.
   • Search and select the IAM role linked to the Lambda function used for rotation.
   • Review the role's permissions and ensure it has access to Secrets Manager.
6. 3.

   Test Rotation Script: Execute the provided code snippet (mentioned under "Necessary Codes") in your preferred Python environment. Ensure that the code runs successfully and initiates the rotation process for a specific secret.

8. 4.

   Review CloudTrail Logs: Enable CloudTrail logging for AWS Secrets Manager to capture rotation-related events, such as errors or failures.

   • Open the CloudTrail console.
   • Select your desired trail.
   • Choose "Event history" from the left navigation pane.
   • Filter and review logs related to Secrets Manager and the specific secret rotation activity.
10. 5.

    Utilize CloudWatch Logs: Monitor Secrets Manager rotation activity using CloudWatch Logs for any issues or anomalies.

    • Open the CloudWatch console.
    • Select "Logs" from the left navigation pane.
    • Choose the log group associated with Secrets Manager.
    • Analyze the log data for any errors or unexpected behavior during rotation.