Skip to main content

🧠 AWS Secrets Manager Secret has not been rotated within the last 90 days - prod.logic.yaml🟢

Uses​

Test Results 🟢​

Generated at: 2026-04-25T12:04:00.452457018Z Open

ResultIdCondition IndexCondition TextRuntime Error
🟢test1✔️ 99✔️ isDisappeared(CA10A1__disappearanceTime__c)✔️ null
🟢test2✔️ 199✔️ extract('CA10A1__deletedDate__c').isNotEmpty()✔️ null
🟢test3✔️ 299✔️ extract('CA10A1__rotationEnabled__c') == true✔️ null
🟢test4✔️ 499✔️ CA10A1__AWS_Secrets_Manager_Secret_Versions__r.has(COMPLIANT)✔️ null
🟢test5✔️ 399✔️ CA10A1__AWS_Secrets_Manager_Secret_Versions__r.has(INCOMPLIANT)✔️ null
🟢test6✔️ 799✔️ extract('CA10A1__lastRotatedDate__c').isNotEmpty() && extract('CA10A1__lastRotatedDate__c').withinLastDays(90)✔️ null
🟢test7✔️ 599✔️ extract('CA10A1__lastRotatedDate__c').isNotEmpty() && extract('CA10A1__lastRotatedDate__c').beyondLastDays(90)✔️ null
🟢test8✔️ 699✔️ extract('CA10A1__lastRotatedDate__c').isEmpty()✔️ null
🟢test9✔️ 799✔️ extract('CA10A1__lastRotatedDate__c').isNotEmpty() && extract('CA10A1__lastRotatedDate__c').withinLastDays(90)✔️ null

Generation Bundle​

FileMD5
Open/ce/ca/aws/secrets-manager/secret-rotated-within-90-days/policy.yamlAD2286117C039A02EA5656BA2099E8C6
Open/ce/ca/aws/secrets-manager/secret-rotated-within-90-days/prod.logic.yamlD454088E478DCC5E5003B67BC42C91A2
Open/ce/ca/aws/secrets-manager/secret-rotated-within-90-days/test-data.json56B352D43DE4320CA67316811CAB23CC
Open/types/CA10A1__CaAwsSecretsManagerSecret__c/object.extracts.yamlEE2C582B7F073CDD9BCEC537B36DB97A
Open/types/CA10A1__CaAwsSecretsManagerSecretVersion__c/object.extracts.yaml6165213EA1A76164E1715F46F1832613

Available Commands​

repo-manager policies generate FULL /ce/ca/aws/secrets-manager/secret-rotated-within-90-days/prod.logic.yaml
repo-manager policies generate DEBUG /ce/ca/aws/secrets-manager/secret-rotated-within-90-days/prod.logic.yaml
repo-manager policies generate CAPTURE_TEST_DATA /ce/ca/aws/secrets-manager/secret-rotated-within-90-days/prod.logic.yaml
repo-manager policies generate TESTS /ce/ca/aws/secrets-manager/secret-rotated-within-90-days/prod.logic.yaml
# Execute tests
repo-manager policies test /ce/ca/aws/secrets-manager/secret-rotated-within-90-days/prod.logic.yaml

Content​

Open File

---
inputType: "CA10A1__CaAwsSecretsManagerSecret__c"
testData:
  - file: "test-data.json"
importExtracts:
  - file: "/types/CA10A1__CaAwsSecretsManagerSecret__c/object.extracts.yaml"
conditions:
  - status: "INAPPLICABLE"
    currentStateMessage: "This secret is not active."
    check:
      NOT_EMPTY:
        arg:
          EXTRACT: "CA10A1__deletedDate__c"
  - status: "INAPPLICABLE"
    currentStateMessage: "Automatic rotation is enabled for this secret."
    check:
      IS_EQUAL:
        left:
          EXTRACT: "CA10A1__rotationEnabled__c"
        right:
          BOOLEAN: true
  - status: "INCOMPLIANT"
    currentStateMessage: "The current secret version was created more than 90 days ago."
    remediationMessage: "Rotate the secret at least every 90 days."
    check:
      RELATED_LIST_HAS:
        status: "INCOMPLIANT"
        relationshipName: "CA10A1__AWS_Secrets_Manager_Secret_Versions__r"
  - status: "COMPLIANT"
    currentStateMessage: "The current secret version was created within the last 90 days."
    check:
      RELATED_LIST_HAS:
        status: "COMPLIANT"
        relationshipName: "CA10A1__AWS_Secrets_Manager_Secret_Versions__r"
  - status: "INCOMPLIANT"
    currentStateMessage: "The secret was last rotated more than 90 days ago."
    remediationMessage: "Rotate the secret at least every 90 days."
    check:
      AND:
        args:
          - NOT_EMPTY:
              arg:
                EXTRACT: "CA10A1__lastRotatedDate__c"
          - IS_BEYOND_LAST_DAYS:
              offsetDays: 90
              arg:
                EXTRACT: "CA10A1__lastRotatedDate__c"
  - status: "INCOMPLIANT"
    currentStateMessage: "The secret has no recorded rotation date."
    remediationMessage: "Rotate the secret at least every 90 days."
    check:
      IS_EMPTY:
        arg:
          EXTRACT: "CA10A1__lastRotatedDate__c"
  - status: "COMPLIANT"
    currentStateMessage: "The secret was rotated within the last 90 days."
    check:
      AND:
        args:
          - NOT_EMPTY:
              arg:
                EXTRACT: "CA10A1__lastRotatedDate__c"
          - IS_WITHIN_LAST_DAYS:
              offsetDays: 90
              arg:
                EXTRACT: "CA10A1__lastRotatedDate__c"
otherwise:
  status: "UNDETERMINED"
  currentStateMessage: "There is not enough data to determine the secret rotation status."
relatedLists:
  - relationshipName: "CA10A1__AWS_Secrets_Manager_Secret_Versions__r"
    importExtracts:
      - file: "/types/CA10A1__CaAwsSecretsManagerSecretVersion__c/object.extracts.yaml"
    conditions:
      - status: "COMPLIANT"
        currentStateMessage: "This is the current secret version and it was created within the last 90 days."
        check:
          AND:
            args:
              - CONTAINS:
                  arg:
                    EXTRACT: "CA10A1__versionStages__c"
                  search:
                    TEXT: "AWSCURRENT"
              - IS_WITHIN_LAST_DAYS:
                  offsetDays: 90
                  arg:
                    EXTRACT: "CA10A1__createdDate__c"
      - status: "INCOMPLIANT"
        currentStateMessage: "This is the current secret version and it was created more than 90 days ago."
        remediationMessage: "Rotate the secret at least every 90 days."
        check:
          AND:
            args:
              - CONTAINS:
                  arg:
                    EXTRACT: "CA10A1__versionStages__c"
                  search:
                    TEXT: "AWSCURRENT"
              - IS_BEYOND_LAST_DAYS:
                  offsetDays: 90
                  arg:
                    EXTRACT: "CA10A1__createdDate__c"
    otherwise:
      status: "INAPPLICABLE"
      currentStateMessage: "This secret version is not the current version."