Find Secrets Manager Secrets Without Rotation

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReportRotationHealth",
      "Effect": "Allow",
      "Action": "secretsmanager:ListSecrets",
      "Resource": "*"
    },
    {
      "Sid": "RetryRotationOnlyWithApply",
      "Effect": "Allow",
      "Action": "secretsmanager:RotateSecret",
      "Resource": "arn:aws:secretsmanager:*:*:secret:*"
    },
    {
      "Sid": "InvokeRotationFunctionsOnlyWithApply",
      "Effect": "Allow",
      "Action": "lambda:InvokeFunction",
      "Resource": "arn:aws:lambda:*:*:function:*"
    }
  ]
}

// find-secrets-without-rotation.ts
// Reports rotation health for every Secrets Manager secret in the chosen Regions: rotation off, overdue,
// never completed, older than --max-days, or stuck with a pending version. It never reads secret values.
// With --apply it retries rotation (RotateSecret with the stored configuration) only for secrets that already
// have rotation enabled with a Lambda function and are overdue. It never turns rotation on by itself.
// Usage:
//   npx tsx find-secrets-without-rotation.ts [--regions us-east-1,eu-west-1] [--max-days 90] [--apply]
import {
  SecretsManagerClient,
  RotateSecretCommand,
  paginateListSecrets,
  type SecretListEntry,
} from "@aws-sdk/client-secrets-manager";

const args = process.argv.slice(2);
const flag = (name: string): string | undefined => {
  const i = args.indexOf(name);
  return i >= 0 ? args[i + 1] : undefined;
};
const regions = (flag("--regions") ?? process.env.AWS_REGION ?? "us-east-1")
  .split(",")
  .map((r) => r.trim())
  .filter(Boolean);
const maxDays = Number(flag("--max-days") ?? "90");
const apply = args.includes("--apply");
const DAY_MS = 86_400_000;
const GRACE_MS = DAY_MS; // a rotation window can end up to a day after the scheduled date

interface Row {
  Region: string;
  Secret: string;
  Rotation: string;
  Schedule: string;
  LastRotated: string;
  NextRotation: string;
  Findings: string;
}

interface Checked {
  row: Row;
  retryable: boolean;
  arn: string;
}

const day = (d: Date | undefined): string => (d ? d.toISOString().slice(0, 10) : "-");
const errText = (err: unknown): string => (err instanceof Error ? `${err.name}: ${err.message}` : String(err));

// Interval in days from AutomaticallyAfterDays or a rate() expression; cron() schedules return undefined.
function intervalDays(s: SecretListEntry): number | undefined {
  const rules = s.RotationRules;
  if (rules?.AutomaticallyAfterDays) return rules.AutomaticallyAfterDays;
  const m = rules?.ScheduleExpression?.match(/^rate\((\d+)\s+(day|days|hour|hours)\)$/);
  if (!m) return undefined;
  return m[2].startsWith("hour") ? Number(m[1]) / 24 : Number(m[1]);
}

// A version labelled AWSPENDING that is not also AWSCURRENT means a rotation started and never finished.
function stuckPending(s: SecretListEntry): boolean {
  return Object.values(s.SecretVersionsToStages ?? {}).some(
    (stages) => stages.includes("AWSPENDING") && !stages.includes("AWSCURRENT"),
  );
}

function check(region: string, s: SecretListEntry, now: number): Checked {
  const findings: string[] = [];
  const managedBy = s.OwningService;
  const interval = intervalDays(s);
  const last = s.LastRotatedDate ?? undefined;
  const reference = (last ?? s.CreatedDate)?.getTime();
  const ageDays = reference !== undefined ? Math.floor((now - reference) / DAY_MS) : undefined;
  let overdue = false;

  if (!s.RotationEnabled) {
    findings.push(s.RotationLambdaARN ? "rotation turned off (a Lambda function is still configured)" : "rotation not enabled");
  } else {
    if (s.NextRotationDate && s.NextRotationDate.getTime() + GRACE_MS < now) {
      overdue = true;
      findings.push(`overdue: next rotation was due ${day(s.NextRotationDate)}`);
    }
    if (!last && interval !== undefined && ageDays !== undefined && ageDays > interval + 1) {
      overdue = true;
      findings.push("never rotated since creation");
    }
    if (stuckPending(s)) findings.push("AWSPENDING version left behind: check the rotation function logs");
  }
  if (ageDays !== undefined && ageDays > maxDays) findings.push(`no rotation recorded for ${ageDays} days (policy ${maxDays})`);

  const schedule = s.RotationRules?.ScheduleExpression ?? (interval ? `every ${interval} days` : "-");
  const rotation = !s.RotationEnabled
    ? "OFF"
    : managedBy
      ? `managed by ${managedBy}`
      : s.RotationLambdaARN
        ? `Lambda ${s.RotationLambdaARN.split(":").pop()}`
        : "on";
  return {
    arn: s.ARN ?? s.Name ?? "",
    // Only retry secrets that already rotate through a Lambda function and aren't stuck mid-rotation.
    retryable: Boolean(s.RotationEnabled && s.RotationLambdaARN && !managedBy && overdue && !stuckPending(s)),
    row: {
      Region: region,
      Secret: s.Name ?? "?",
      Rotation: rotation,
      Schedule: schedule,
      LastRotated: day(last),
      NextRotation: day(s.NextRotationDate),
      Findings: findings.join("; ") || "ok",
    },
  };
}

async function scanRegion(region: string): Promise<Checked[]> {
  const sm = new SecretsManagerClient({ region });
  const out: Checked[] = [];
  const now = Date.now();
  for await (const page of paginateListSecrets({ client: sm }, { MaxResults: 100 })) {
    for (const s of page.SecretList ?? []) out.push(check(region, s, now));
  }
  return out;
}

async function main(): Promise<void> {
  const all: Checked[] = [];
  for (const region of regions) {
    try {
      all.push(...(await scanRegion(region)));
    } catch (err) {
      console.error(`${region}: ${errText(err)}`);
      process.exitCode = 1;
    }
  }
  const flagged = all.filter((c) => c.row.Findings !== "ok");
  console.table(flagged.map((c) => c.row));
  console.log(`${all.length} secrets checked, ${flagged.length} with rotation findings.`);

  const retry = flagged.filter((c) => c.retryable);
  if (!apply) {
    console.log(`${retry.length} overdue secrets could be retried with --apply. Nothing was modified.`);
    return;
  }
  for (const c of retry) {
    try {
      // No RotationRules or RotationLambdaARN: rotate now with the configuration already stored on the secret.
      const res = await new SecretsManagerClient({ region: c.row.Region }).send(new RotateSecretCommand({ SecretId: c.arn }));
      console.log(`Started rotation of ${c.row.Secret} (${c.row.Region}), new version ${res.VersionId ?? "?"}`);
    } catch (err) {
      console.error(`Could not rotate ${c.row.Secret}: ${errText(err)}`);
      process.exitCode = 1;
    }
  }
}

main().catch((err) => {
  console.error(errText(err));
  process.exit(1);
});

npm install @aws-sdk/client-secrets-manager
npm install --save-dev tsx typescript @types/node

# Report only
AWS_PROFILE=readonly npx tsx find-secrets-without-rotation.ts --regions us-east-1,eu-west-1 --max-days 90

# Retry overdue Lambda rotations
AWS_PROFILE=secrets-admin npx tsx find-secrets-without-rotation.ts --regions us-east-1 --apply

┌─────────┬─────────────┬───────────────────────┬───────────────────────────────────────┬───────────────────────┬──────────────┬──────────────┬───────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ (index) │ Region      │ Secret                │ Rotation                              │ Schedule              │ LastRotated  │ NextRotation │ Findings                                                                                                      │
├─────────┼─────────────┼───────────────────────┼───────────────────────────────────────┼───────────────────────┼──────────────┼──────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ 0       │ 'us-east-1' │ 'prod/stripe-api-key' │ 'OFF'                                 │ '-'                   │ '-'          │ '-'          │ 'rotation not enabled; no rotation recorded for 400 days (policy 90)'                                         │
│ 1       │ 'us-east-1' │ 'prod/orders-db'      │ 'Lambda SecretsManagermysql-rotation' │ 'every 30 days'       │ '2026-07-15' │ '2026-08-14' │ 'overdue: next rotation was due 2026-08-14'                                                                   │
│ 2       │ 'us-east-1' │ 'staging/redis-auth'  │ 'Lambda redis-rotator'                │ 'cron(0 4 ? * SUN *)' │ '2026-09-08' │ '2026-09-22' │ 'overdue: next rotation was due 2026-09-22; AWSPENDING version left behind: check the rotation function logs' │
│ 3       │ 'us-east-1' │ 'legacy/ftp'          │ 'OFF'                                 │ '-'                   │ '2026-03-02' │ '-'          │ 'rotation turned off (a Lambda function is still configured); no rotation recorded for 210 days (policy 90)'  │
└─────────┴─────────────┴───────────────────────┴───────────────────────────────────────┴───────────────────────┴──────────────┴──────────────┴───────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
5 secrets checked, 4 with rotation findings.
Started rotation of prod/orders-db (us-east-1), new version c1d2e3f4-0000-4000-8000-000000000000