rotation_schedules

Creates, updates, deletes or gets a rotation_schedule resource or lists rotation_schedules in a region

Overview

Name	rotation_schedules
Type	Resource
Description	Resource Type definition for AWS::SecretsManager::RotationSchedule
Id	aws.secretsmanager.rotation_schedules

Fields

Name	Datatype	Description
hosted_rotation_lambda	object	Creates a new Lambda rotation function based on one of the Secrets Manager rotation function templates. To use a rotation function that already exists, specify RotationLambdaARN instead.
secret_id	string	The ARN or name of the secret to rotate.
id	string	The ARN of the secret.
rotate_immediately_on_update	boolean	Specifies whether to rotate the secret immediately or wait until the next scheduled rotation window.
rotation_lambda_arn	string	The ARN of an existing Lambda rotation function. To specify a rotation function that is also defined in this template, use the Ref function.
rotation_rules	object	A structure that defines the rotation configuration for this secret.
region	string	AWS region.

For more information, see AWS::SecretsManager::RotationSchedule.

Methods

Name	Accessible by	Required Params
create_resource	INSERT	SecretId, region
delete_resource	DELETE	data__Identifier, region
update_resource	UPDATE	data__Identifier, data__PatchDocument, region
list_resources	SELECT	region
get_resource	SELECT	data__Identifier, region

SELECT examples

Gets all rotation_schedules in a region.

SELECT
region,
hosted_rotation_lambda,
secret_id,
id,
rotate_immediately_on_update,
rotation_lambda_arn,
rotation_rules
FROM aws.secretsmanager.rotation_schedules
WHERE region = 'us-east-1';

Gets all properties from an individual rotation_schedule.

SELECT
region,
hosted_rotation_lambda,
secret_id,
id,
rotate_immediately_on_update,
rotation_lambda_arn,
rotation_rules
FROM aws.secretsmanager.rotation_schedules
WHERE region = 'us-east-1' AND data__Identifier = '<Id>';

INSERT example

Use the following StackQL query and manifest file to create a new rotation_schedule resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO aws.secretsmanager.rotation_schedules (
 SecretId,
 region
)
SELECT 
'{{ SecretId }}',
'{{ region }}';

All Properties

/*+ create */
INSERT INTO aws.secretsmanager.rotation_schedules (
 HostedRotationLambda,
 SecretId,
 RotateImmediatelyOnUpdate,
 RotationLambdaARN,
 RotationRules,
 region
)
SELECT 
 '{{ HostedRotationLambda }}',
 '{{ SecretId }}',
 '{{ RotateImmediatelyOnUpdate }}',
 '{{ RotationLambdaARN }}',
 '{{ RotationRules }}',
 '{{ region }}';

Manifest

version: 1
name: stack name
description: stack description
providers:
  - aws
globals:
  - name: region
    value: '{{ vars.AWS_REGION }}'
resources:
  - name: rotation_schedule
    props:
      - name: HostedRotationLambda
        value:
          Runtime: '{{ Runtime }}'
          KmsKeyArn: '{{ KmsKeyArn }}'
          MasterSecretArn: '{{ MasterSecretArn }}'
          RotationLambdaName: '{{ RotationLambdaName }}'
          RotationType: '{{ RotationType }}'
          ExcludeCharacters: '{{ ExcludeCharacters }}'
          VpcSecurityGroupIds: '{{ VpcSecurityGroupIds }}'
          MasterSecretKmsKeyArn: '{{ MasterSecretKmsKeyArn }}'
          SuperuserSecretArn: '{{ SuperuserSecretArn }}'
          SuperuserSecretKmsKeyArn: '{{ SuperuserSecretKmsKeyArn }}'
          VpcSubnetIds: '{{ VpcSubnetIds }}'
      - name: SecretId
        value: '{{ SecretId }}'
      - name: RotateImmediatelyOnUpdate
        value: '{{ RotateImmediatelyOnUpdate }}'
      - name: RotationLambdaARN
        value: '{{ RotationLambdaARN }}'
      - name: RotationRules
        value:
          ScheduleExpression: '{{ ScheduleExpression }}'
          Duration: '{{ Duration }}'
          AutomaticallyAfterDays: '{{ AutomaticallyAfterDays }}'

DELETE example

/*+ delete */
DELETE FROM aws.secretsmanager.rotation_schedules
WHERE data__Identifier = '<Id>'
AND region = 'us-east-1';

Permissions

To operate on the rotation_schedules resource, the following permissions are required:

Read

secretsmanager:DescribeSecret

Create

secretsmanager:RotateSecret,
secretsmanager:DescribeSecret,
lambda:InvokeFunction

Update

secretsmanager:RotateSecret,
secretsmanager:DescribeSecret,
lambda:InvokeFunction

List

secretsmanager:DescribeSecret,
secretsmanager:ListSecrets

Delete

secretsmanager:CancelRotateSecret,
secretsmanager:DescribeSecret