skills.rest
AnasIsmai1
AnasIsmai1COMMUNITY
Explore all skills by this author →
WebsiteGitHub

aws-secrets-rotation

Automate rotation of AWS Secrets Manager credentials using Lambda functions and rotation policies.

Updated Sep 20, 2024
Search Tags:#automation#security#aws#credentials#lambda#rotation#secrets manager
One-click install
npx skills add https://github.com/AnasIsmai1/dotfiles --skill aws-secrets-rotation-anasismai1
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: aws-secrets-rotation
Source: https://github.com/AnasIsmai1/dotfiles/tree/main/claude/.claude/skills/security/aws-secrets-rotation
Command: npx skills add https://github.com/AnasIsmai1/dotfiles --skill aws-secrets-rotation-anasismai1

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires boto3, pymysql, requests.

What problem does it solve? Managing credential rotation manually is error-prone and often skipped, leaving databases, API keys, and SSH keys exposed past their safe lifetime. This Skill provides ready-to-use commands, Lambda rotation functions, and audit scripts to automate secrets rotation in AWS Secrets Manager. ## Core Features & Use Cases - Automatic Rotation Setup: Enable scheduled rotation for RDS, DocumentDB, Redshift, and ElastiCache credentials with AWS-managed or custom Lambda functions. - Custom Rotation Functions: Implement the four-step rotation lifecycle (createSecret, setSecret, testSecret, finishSecret) for third-party API keys like Stripe. - Monitoring & Compliance: Audit rotation status across all secrets, set CloudWatch alarms for failures, and generate compliance reports flagging overdue or never-rotated secrets. - Use Case: A security engineer needs to comply with a 90-day rotation policy. Use this Skill to enable automatic rotation on all RDS secrets, deploy a custom Lambda for Stripe API keys, and run the audit script to find non-compliant secrets. ## Quick Start Use the aws-secrets-rotation skill to set up automatic 30-day rotation for my production RDS MySQL credentials stored in Secrets Manager.

Frequently Asked Questions about aws-secrets-rotation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enable automatic rotation for RDS credentials in AWS Secrets Manager?▼

Use the aws secretsmanager rotate-secret command with the --rotation-lambda-arn pointing to a rotation Lambda and --rotation-rules AutomaticallyAfterDays set to your schedule. AWS provides managed rotation Lambda templates for RDS MySQL, PostgreSQL, and other engines.

How to rotate third-party API keys like Stripe with Secrets Manager?▼

Write a custom Lambda function implementing the four rotation steps: createSecret generates a new key via the provider's API, testSecret validates it, and finishSecret revokes the old key and promotes the new version to AWSCURRENT. Attach this Lambda to the secret with rotate-secret.

What are the four steps of a Secrets Manager rotation Lambda?▼

The steps are createSecret (generate and store a pending credential version), setSecret (apply the new credential to the target service), testSecret (verify the new credential works), and finishSecret (promote the pending version to AWSCURRENT).

How do I audit which secrets are overdue for rotation?▼

Run a script that lists secrets with aws secretsmanager list-secrets, reads RotationEnabled and LastRotatedDate for each, and compares days since last rotation against the configured schedule. The Skill includes a bash audit script and a Python compliance report for this.

Can I force an emergency rotation when credentials are compromised?▼

Yes, call aws secretsmanager rotate-secret with the secret ID to trigger immediate rotation outside the normal schedule. Afterwards verify completion by checking LastRotatedDate with describe-secret and confirm applications picked up the new credentials.

What are the limitations of AWS Secrets Manager rotation?▼

Rotation requires a Lambda function with network access to the target service, so secrets in private subnets need VPC-enabled Lambdas. Custom third-party rotations depend on the provider's API supporting programmatic key creation and revocation, and all rotation logic should be tested in non-production first.

Related Skills

Explore More Software Engineering Skills→
ToanPV90ToanPV90

aws-secrets-manager

Store and rotate sensitive credentials in AWS Secrets Manager.

Community
Advanced
tjl8787tjl8787

secrets-manager

Manage AWS Secrets Manager secrets with boto3 and AWS CLI.

Community
Advanced
awsaws
2.3k

creating-secrets-using-best-practices

Automate AWS Secrets Manager secret creation with encryption, rotation, and auditing.

Official
Advanced
xalgordxalgord
954

implementing-hashicorp-vault-dynamic-secrets

Configures HashiCorp Vault dynamic secrets engines for databases, AWS, and PKI certificates.

Community
Advanced