Rule: Secrets Manager Secrets Rotation Schedule
Ensure Secrets Manager secrets are rotated as per the schedule to enhance security measures.
| Rule | Secrets Manager secrets should be rotated as per the rotation schedule |
| Framework | NIST 800-53 Revision 4 |
| Severity | ✔ Critical |
Rule Description
Secrets Manager is a service provided by Amazon Web Services (AWS) that allows you to securely store and manage sensitive information such as passwords, database credentials, and API keys. To maintain the security of this sensitive information, it is important to rotate secrets regularly according to the rotation schedule outlined in NIST 800-53 Revision 4.
Troubleshooting
If secrets are not being rotated according to the rotation schedule, it could potentially lead to security vulnerabilities. Manual intervention may be required to troubleshoot and remedy this issue.
Necessary Codes
There are no specific codes associated with this rule, as the rotation schedule is typically managed through configurations within Secrets Manager.
Remediation Steps
To ensure the rotation of Secrets Manager secrets aligns with the rotation schedule specified in NIST 800-53 Revision 4, follow these steps:
- 1.
Login to the AWS Management Console.
- 2.
Open the Secrets Manager service.
- 3.
Review the current rotation schedule for all secrets in Secrets Manager.
- 4.
Determine if any secrets are not adhering to the rotation schedule specified by NIST 800-53 Revision 4.
- 5.
For secrets that require rotation:
- Identify the relevant application or service that is using the secret.
- Ensure that the application or service can handle secret rotation without interruptions.
- Update the rotation schedule for the secret to align with the NIST 800-53 Revision 4 recommendations.
- Modify any relevant code or configuration files to reflect the updated rotation schedule.
- Test the rotation process to ensure it functions as expected and does not disrupt any dependent applications or services.
- 6.
For secrets that are being rotated as required:
- Monitor the rotation process to ensure it continues to function properly.
- Regularly review and update the rotation schedule if necessary, based on changes in application requirements or organizational policies.
By following these steps, you can ensure that Secrets Manager secrets are rotated in accordance with the rotation schedule defined in NIST 800-53 Revision 4, thus maintaining the security and integrity of your sensitive information.