AWS Secrets Manager's automatic rotation feature gets pitched as the fix for long-lived credentials. It's a genuine improvement over a static password that never changes, but rotation and elimination solve different problems, and treating rotation as the finish line leaves a real gap in a SOC 2 audit story.
What Rotation Actually Buys You
Secrets Manager rotation runs a Lambda function on a schedule that generates a new credential, updates it at the target system (an RDS database, a third-party API), and stores the new value — all without application downtime if configured correctly. This reduces the blast radius if a secret leaks, since a compromised credential has a shorter useful life before it's replaced.
But the secret still exists as a long-lived credential between rotations. If it's exfiltrated on day one of a 30-day rotation window, an attacker has nearly a month of valid access. Rotation is risk mitigation, not risk elimination.
What Elimination Actually Means
Credential elimination replaces the secret entirely with a federated, short-lived identity — an IAM role assumed via OIDC, SAML, or a workload identity provider, where the credential is a token that's valid for minutes and issued fresh for each session. There's no secret sitting in Secrets Manager for an attacker to steal, because there's nothing static to steal in the first place.
When Rotation Is the Right Tool
Not everything can federate. Third-party SaaS API keys, legacy on-prem database credentials, and systems without OIDC/SAML support are common cases where rotation is the realistic ceiling:
import boto3
import json
def lambda_handler(event, context):
"""Rotation Lambda for a third-party API key stored in Secrets Manager."""
secrets_client = boto3.client("secretsmanager")
step = event["Step"]
secret_id = event["SecretId"]
token = event["ClientRequestToken"]
if step == "createSecret":
new_key = call_vendor_api_to_generate_new_key()
secrets_client.put_secret_value(
SecretId=secret_id,
ClientRequestToken=token,
SecretString=json.dumps({"api_key": new_key}),
VersionStages=["AWSPENDING"],
)
elif step == "setSecret":
pending = secrets_client.get_secret_value(SecretId=secret_id, VersionStage="AWSPENDING")
activate_key_at_vendor(json.loads(pending["SecretString"])["api_key"])
elif step == "testSecret":
pending = secrets_client.get_secret_value(SecretId=secret_id, VersionStage="AWSPENDING")
verify_key_works(json.loads(pending["SecretString"])["api_key"])
elif step == "finishSecret":
secrets_client.update_secret_version_stage(
SecretId=secret_id, VersionStage="AWSCURRENT", MoveToVersionId=token
)
When Elimination Is the Right Call
Anything talking to AWS itself — CI/CD pipelines, application-to-AWS-service calls, cross-account access — should almost always move to federation instead of a rotated IAM user key. If you're rotating an IAM access key today, that's usually a signal the credential shouldn't exist at all, not a signal to rotate it faster.
Building the Decision Into an Engagement
Our credential elimination engagements start with an inventory: every secret in Secrets Manager, Parameter Store, and any lingering .env files, tagged by whether the target system supports federation. Anything that can eliminate, does. Anything that can't, gets proper rotation with tested Lambda functions and monitored rotation failures — because a rotation Lambda that silently breaks is its own audit finding.
Frequently Asked Questions
Is rotating a secret every 24 hours basically as good as elimination?
Not quite — a compromised credential is still valid for up to 24 hours, and you still carry the operational risk of rotation failures breaking production. Elimination removes both the exposure window and the rotation-failure risk simultaneously, when it's feasible.
What SOC 2 control does this map to?
This work typically supports CC6.1 (logical access controls) and CC6.3 (credential management) evidence, since auditors want to see both an inventory of credentials and a documented approach — rotation or elimination — for managing their lifecycle.
Can Secrets Manager rotation and workload identity federation coexist in the same environment?
Yes, and in practice most environments run both — federation for AWS-native access, rotation for the third-party systems that can't yet support federated identity.
How long does a typical elimination migration take?
It depends on how many systems are involved and how tangled the existing credential usage is, but a focused engagement on a single high-risk credential class (like CI/CD access keys) is often measurable in weeks, not quarters.
Talk to us about your credential elimination pilot → rutagon.com/contact or call 907-841-8407 / contact@rutagon.com.