AWS Secret Manager Automatic Key Rotation is not enabled misconfiguration detected in code

AWS Secret Manager Automatic Key Rotation is not enabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_AWS_57
Category - Subcategory	Storage - Alerting
Provider	AWS
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	ad71cafd-f8da-4f2e-9b4b-76c1792dcdc7

Impact

This rule detects whether rotation is enabled for Secrets in AWS Secrets Manager. Enabling rotation for secrets helps reduce the risk of unauthorized access to the secrets.

How to Fix

Resource: aws_secretsmanager_secret

• Arguments: aws_secretsmanager_secret_rotation

In this Terraform example, an aws_secretsmanager_secret resource is declared to create a new secret in AWS Secrets Manager, and an aws_secretsmanager_secret_rotation resource is configured to enable automatic rotation for that secret. The aws_secretsmanager_secret_rotation resource references the secret by its ID and specifies a Lambda function ARN that will handle the rotation logic, with rotation rules stating how frequently the secret should be rotated (e.g., every 30 days). To satisfy the rule, the example assumes that the Lambda function and necessary IAM roles and policies are correctly set up to perform the rotation, which are essential components for enabling and executing automatic rotation. [source,go]

resource "aws_secretsmanager_secret" "example" { name = "example-secret"

Other necessary configurations

}

+resource "aws_secretsmanager_secret_rotation" "example" {

• secret_id = aws_secretsmanager_secret.example.id
• rotation_lambda_arn = aws_lambda_function.example.arn
• rotation_rules {
• automatically_after_days = 30
• }
• Other necessary configurations

+}