Secrets Manager secret should have automatic rotation configured

What it checks

Secrets Manager secret should have automatic rotation configured

Where it applies

Terraform: aws_secretsmanager_secret

CloudFormation: AWS::SecretsManager::Secret

How to fix it

1. Add an aws_secretsmanager_secret_rotation referencing the secret, with automatically_after_days = 30 or 90
2. Implement the rotation Lambda (AWS publishes templates for RDS, DocumentDB, Redshift, and custom use cases)

Frameworks

• AWS FSBP SecretsManager.1
• AWS FSBP SecretsManager.4
• SOC 2 CC6.1
• SOC 2 CC6.3
• PCI-DSS v4.0.1/8.6.3
• PCI-DSS v4.0.1/8.3.9
• HIPAA 164.312(a)(1)
• HIPAA 164.312(d)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules