Skip to main content

🛡️ AWS Secrets Manager Secret has not been accessed in over 90 days🟢

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS Secrets Manager Secrets that have not been accessed or updated within the last 90 days.

Rationale​

Secrets that are not regularly accessed are often associated with decommissioned applications or obsolete testing environments. Retaining unused secrets increases the security risk by expanding the pool of credentials that could be exposed in the event of an account compromise.

In addition, AWS charges a monthly fee for each stored secret. Identifying and removing unused secrets helps reduce unnecessary costs and improve overall security posture.

Audit​

This policy flags an AWS Secrets Manager Secret as INCOMPLIANT when either of the following conditions is met:

  • The Last Accessed Date is empty and the Last Changed Date is more than 90 days old.
  • The Last Accessed Date is more than 90 days old.

Secrets that are scheduled for deletion are marked as INAPPLICABLE.

Remediation​

Open File

Remediation​

Decommission Unused Secrets​

From the Command Line​

Before deleting a secret, confirm with the owning team or application that the secret is no longer required. If the secret is still needed but accessed infrequently, enable automatic rotation to ensure the credentials remain secure and up to date (see: AWS Secrets Manager Secret Automatic Rotation is not enabled Remediation).

Once the secret has been verified as unused, schedule it for deletion using the AWS CLI:

aws secretsmanager delete-secret \
    --secret-id {{secret-id}} \
    --recovery-window-in-days 30

AWS Secrets Manager enforces a mandatory recovery window of 7 to 30 days. During this period, the deletion can be canceled if the secret is needed again.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [SecretsManager.3] Remove unused Secrets Manager secrets1no data
💼 Cloudaware Framework → 💼 Expiration Management15no data
💼 FedRAMP High Security Controls → 💼 AC-2(1) Automated System Account Management (M)(H)25no data
💼 FedRAMP Moderate Security Controls → 💼 AC-2(1) Automated System Account Management (M)(H)25no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-2(1) Account Management _ Automated System Account Management425no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-3(15) Access Enforcement _ Discretionary and Mandatory Access Control20no data