Find Unused Secrets Manager Secrets

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListSecretMetadata",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeRegions",
        "secretsmanager:ListSecrets"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ScheduleDeletionApplyOnly",
      "Effect": "Allow",
      "Action": "secretsmanager:DeleteSecret",
      "Resource": "arn:aws:secretsmanager:*:111122223333:secret:*"
    }
  ]
}

// find-unused-secrets-manager-secrets.ts
// Lists Secrets Manager secrets in each Region and reports the ones nobody has retrieved for --days days,
// using LastAccessedDate from ListSecrets. It never calls GetSecretValue and never prints a secret value.
// Dry run by default: with --apply it schedules deletion with a recovery window (never a forced delete).
// Usage: npx tsx find-unused-secrets-manager-secrets.ts [--regions=us-east-1] [--days=90] [--apply] [--recovery-days=30]
import { EC2Client, DescribeRegionsCommand } from "@aws-sdk/client-ec2";
import { SecretsManagerClient, paginateListSecrets, DeleteSecretCommand } from "@aws-sdk/client-secrets-manager";

const PRICE_PER_SECRET_MONTH = 0.4; // USD, us-east-1, checked September 2026; replicas are billed as separate secrets

const args = process.argv.slice(2);
const flag = (name: string) => args.find((a) => a.startsWith(`--${name}=`))?.split("=")[1];
const apply = args.includes("--apply");
const days = Number(flag("days") ?? "90");
const recoveryDays = Number(flag("recovery-days") ?? "30");
const regionArg = flag("regions")?.split(",").map((s) => s.trim()).filter(Boolean);
if (!Number.isInteger(days) || days < 1) {
  console.error("--days must be a positive whole number");
  process.exit(1);
}
if (!Number.isInteger(recoveryDays) || recoveryDays < 7 || recoveryDays > 30) {
  console.error("--recovery-days must be from 7 to 30");
  process.exit(1);
}

type Status = "UNUSED" | "in use" | "managed" | "replica" | "scheduled";
interface Row {
  Region: string;
  Secret: string;
  LastAccessed: string;
  Created: string;
  IdleDays: number;
  Rotation: string;
  Status: Status;
  Note: string;
}

const DAY_MS = 86_400_000;
const isoDay = (d?: Date) => (d ? d.toISOString().slice(0, 10) : "never");

async function listRegions(): Promise<string[]> {
  if (regionArg) return regionArg;
  const out = await new EC2Client({}).send(new DescribeRegionsCommand({}));
  return (out.Regions ?? []).map((r) => r.RegionName ?? "").filter(Boolean).sort();
}

async function scanRegion(region: string): Promise<Row[]> {
  const sm = new SecretsManagerClient({ region });
  const rows: Row[] = [];
  const arns = new Map<Row, string>(); // full ARNs for DeleteSecret, kept out of the table
  const now = Date.now();

  // ListSecrets returns metadata only: no SecretString or SecretBinary.
  for await (const page of paginateListSecrets({ client: sm }, { MaxResults: 100 })) {
    for (const s of page.SecretList ?? []) {
      // LastAccessedDate has day granularity and is omitted if the secret was never retrieved in this Region.
      const since = s.LastAccessedDate ?? s.CreatedDate;
      const idle = since ? Math.floor((now - since.getTime()) / DAY_MS) : 0;
      const row: Row = {
        Region: region,
        Secret: s.Name ?? s.ARN ?? "?",
        LastAccessed: isoDay(s.LastAccessedDate),
        Created: isoDay(s.CreatedDate),
        IdleDays: idle,
        Rotation: s.RotationEnabled ? `on, last ${isoDay(s.LastRotatedDate)}` : "off",
        Status: idle >= days ? "UNUSED" : "in use",
        Note: "",
      };
      if (s.OwningService) {
        row.Status = "managed";
        row.Note = `created by ${s.OwningService}; remove it through that service`;
      } else if (s.PrimaryRegion && s.PrimaryRegion !== region) {
        row.Status = "replica";
        row.Note = `replica of ${s.PrimaryRegion}; remove the replica from the primary`;
      }
      rows.push(row);
      if (s.ARN) arns.set(row, s.ARN);
    }
  }

  if (apply) {
    for (const row of rows.filter((r) => r.Status === "UNUSED")) {
      try {
        const out = await sm.send(new DeleteSecretCommand({ SecretId: arns.get(row) ?? row.Secret, RecoveryWindowInDays: recoveryDays }));
        row.Status = "scheduled";
        row.Note = `deletion on ${isoDay(out.DeletionDate)}; RestoreSecret cancels it`;
      } catch (err) {
        // For example InvalidRequestException when the secret still has replicas in other Regions.
        row.Note = `not deleted: ${err instanceof Error ? err.name : String(err)}`;
      }
    }
  }
  return rows;
}

async function main(): Promise<void> {
  const rows: Row[] = [];
  for (const region of await listRegions()) {
    try {
      rows.push(...(await scanRegion(region)));
    } catch (err) {
      console.error(`${region}: ${err instanceof Error ? err.name : String(err)}`);
    }
  }
  rows.sort((a, b) => Number(b.Status === "UNUSED") - Number(a.Status === "UNUSED") || b.IdleDays - a.IdleDays);
  console.table(rows);

  const unused = rows.filter((r) => r.Status === "UNUSED").length;
  const scheduled = rows.filter((r) => r.Status === "scheduled").length;
  const monthly = (unused + scheduled) * PRICE_PER_SECRET_MONTH;
  console.log(`${rows.length} secret(s); ${unused + scheduled} not retrieved in ${days}+ days, about $${monthly.toFixed(2)}/month.`);
  if (!apply && unused) console.log(`Dry run. Re-run with --apply to schedule deletion with a ${recoveryDays}-day recovery window.`);
  if (scheduled) console.log(`${scheduled} secret(s) scheduled for deletion. No secret values were read or printed.`);
}

main().catch((err) => {
  console.error(err instanceof Error ? `${err.name}: ${err.message}` : err);
  process.exit(1);
});

npm install @aws-sdk/client-secrets-manager @aws-sdk/client-ec2
npm install --save-dev tsx typescript

# Report secrets not retrieved in 90+ days, every enabled Region
AWS_PROFILE=security-audit npx tsx find-unused-secrets-manager-secrets.ts

# Stricter threshold, one Region, schedule deletion with the shortest recovery window
AWS_PROFILE=secrets-admin npx tsx find-unused-secrets-manager-secrets.ts --regions=us-east-1 --days=180 --apply --recovery-days=7

┌─────────┬─────────────┬───────────────────────────────────────────────┬──────────────┬──────────────┬──────────┬───────────────────────┬───────────┬─────────────────────────────────────────────────────────────┐
│ (index) │ Region      │ Secret                                        │ LastAccessed │ Created      │ IdleDays │ Rotation              │ Status    │ Note                                                        │
├─────────┼─────────────┼───────────────────────────────────────────────┼──────────────┼──────────────┼──────────┼───────────────────────┼───────────┼─────────────────────────────────────────────────────────────┤
│ 0       │ 'us-east-1' │ 'poc/openai-key'                              │ '2025-06-18' │ '2025-05-02' │ 466      │ 'off'                 │ 'UNUSED'  │ ''                                                          │
│ 1       │ 'us-east-1' │ 'legacy/mysql-reporting'                      │ '2025-08-30' │ '2023-11-14' │ 393      │ 'on, last 2026-09-01' │ 'UNUSED'  │ ''                                                          │
│ 2       │ 'us-east-1' │ 'ci/deploy-webhook'                           │ 'never'      │ '2026-03-09' │ 202      │ 'off'                 │ 'UNUSED'  │ ''                                                          │
│ 3       │ 'eu-west-1' │ 'shared/partner-api-key'                      │ 'never'      │ '2025-04-03' │ 542      │ 'off'                 │ 'replica' │ 'replica of us-east-1; remove the replica from the primary' │
│ 4       │ 'us-east-1' │ 'prod/orders-db'                              │ '2026-09-26' │ '2024-02-20' │ 1        │ 'on, last 2026-08-28' │ 'in use'  │ ''                                                          │
│ 5       │ 'us-east-1' │ 'rds!db-3f9c2a1e-7b4d-4e8f-a6c2-1d9e5b7f3a08' │ '2026-09-27' │ '2025-01-12' │ 0        │ 'on, last 2026-09-20' │ 'managed' │ 'created by rds; remove it through that service'            │
└─────────┴─────────────┴───────────────────────────────────────────────┴──────────────┴──────────────┴──────────┴───────────────────────┴───────────┴─────────────────────────────────────────────────────────────┘
14 secret(s); 3 not retrieved in 90+ days, about $1.20/month.
Dry run. Re-run with --apply to schedule deletion with a 30-day recovery window.