Skip to main content

SCHEDULE AUTOMATIC ROTATION FOR A SECRETS MANAGER SECRET

This guide shows you how to configure AWS Secrets Manager to rotate an existing secret every 30 days with an existing rotation Lambda function. The configuration is kept as a Swamp behavior.

Prerequisites

  • An existing secret, here myapp/production/db-password
  • An existing rotation Lambda, here arn:aws:lambda:us-east-1:123456789012:function:rotate-db-password
  • AWS credentials available through the default credential chain, or wired into the behavior's accessKeyId, secretAccessKey and sessionToken arguments with vault.get()

Pull the extension

swamp extension pull @swamp/aws/secretsmanager

The output looks like:

INF extension·pull: Pulling "@swamp/aws/secretsmanager"@"2026.10.13.1"
INF extension·pull: Identity verified: "@swamp/aws/secretsmanager"@"2026.10.13.1"
INF extension·pull: Pulled "@swamp/aws/secretsmanager"@"2026.10.13.1"
INF extension·pull: Extracted 12 files:

Define the rotation schedule

Create a behavior of type @swamp/aws/secretsmanager/rotation-schedule named db-password-rotation. If you have not created a behavior before, see Create and Run a Behavior. Set its global arguments to point at the secret and the Lambda:

globalArguments:
  name: db-password-rotation
  SecretId: myapp/production/db-password
  region: us-east-1
  RotationLambdaARN: arn:aws:lambda:us-east-1:123456789012:function:rotate-db-password
  RotationRules:
    AutomaticallyAfterDays: 30

Adjust the schedule for your case:

  • To rotate on a schedule expression instead of a day count, set RotationRules.ScheduleExpression, and optionally RotationRules.Duration, in place of AutomaticallyAfterDays.
  • To have Secrets Manager create the rotation function from one of its templates, set HostedRotationLambda with a RotationType instead of RotationLambdaARN.
  • To rotate as soon as the schedule is applied, set RotateImmediatelyOnUpdate: true.

Apply the schedule

swamp behavior run db-password-rotation create

This command creates the rotation schedule on the secret in AWS and writes SecretsManager RotationSchedule resource state as data.

Refresh the recorded state

swamp behavior run db-password-rotation sync

This command reads the rotation schedule back from AWS. It then writes the current SecretsManager RotationSchedule resource state as data, so the record matches what Secrets Manager reports.

To query that state, see Query and Manage Data. The extensions reference lists every rotation-schedule argument.