Automate AWS Secrets Rotation

AWS Secrets Rotation automates rotation of secrets, credentials, and API keys using AWS Secrets Manager and Lambda. It covers creating secrets - RDS/MySQL, third-party API keys, or binary secrets like SSH private keys via aws secretsmanager create-secret - retrieving them (full value, a specific field via jq, or a binary secret decoded from base64), and enabling automatic rotation on a schedule (rotate-secret --rotation-lambda-arn ... --rotation-rules AutomaticallyAfterDays=30) or immediately. It provides two Lambda rotation function patterns following AWS's four-step contract - createSecret, setSecret, testSecret, finishSecret: one for RDS MySQL passwords (generate a new password, apply it via rds.modify_db_instance, test the connection with pymysql, then promote the new version to AWSCURRENT), and one for a third-party API key, Stripe in the example - create a new key via the provider's API, test it, revoke the old key, then promote. It also covers monitoring and governance: a CloudWatch alarm on the RotationFailed metric, a bash audit script that lists every secret's rotation status and flags ones overdue against their schedule, a Python compliance report that flags secrets with rotation disabled, never rotated, or not rotated within 90 days, and an emergency --rotate-immediately path for a suspected compromise.

Use it when implementing automated secrets rotation, managing credentials securely, or complying with a policy requiring regular key rotation, for AWS-native secrets (RDS, DocumentDB, Redshift, ElastiCache) or third-party credentials (API keys, OAuth tokens, SSH keys, custom credentials). Its stated best practices: test rotation in non-production first, use AWS-managed rotation Lambdas where one exists rather than writing a custom one, add CloudWatch monitoring and failure alerts, and maintain rotation runbooks and regular audits.

Input: a secret's name or ARN, its current value, and, for custom rotation, provider-specific API credentials to mint and revoke keys. Output: a new secret version staged as AWSPENDING, tested, then promoted to AWSCURRENT with the old version's stage removed, plus an audit or compliance report per secret (rotation enabled, last-rotated date, days overdue) and CloudWatch alarms on rotation failures.

• AWS Secrets Manager (create-secret, get-secret-value, rotate-secret, describe-secret, list-secrets)
• AWS Lambda rotation functions following the createSecret/setSecret/testSecret/finishSecret contract
• AWS RDS (modify_db_instance) and CloudWatch alarms
• Application SDKs: boto3 for Python and the AWS SDK for Node.js, for reading secrets at runtime
• Kiro CLI (kiro-cli chat "Use aws-secrets-rotation to ...")

Teams that need to automate credential rotation for AWS-hosted databases or third-party API keys, and want a working Lambda rotation pattern plus monitoring and compliance reporting rather than building it from scratch.