aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

Add PasswordLength to AWS::SecretsManager::RotationSchedule HostedRotationLambda

Open
#1,824 0 comments 2 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::SecretsManager::RotationSchedule

### Resource name

HostedRotationLambda

### Description

When you [generate a new secret](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-secret-generatesecretstring.html), you're allowed to specify password length. I think it also makes sense to include password length as a parameter for rotation schedule. The [documentation](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html) says, "In the [database rotation templates](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html) provided by Secrets Manager, the Lambda function generates a 32 character password for the new version," but sometimes they are [limited to less](https://github.com/aws-samples/aws-secrets-manager-rotation-lambdas/blob/master/SecretsManagerRDSOracleRotationSingleUser/lambda_function.py#L118) (30 for Oracle, which is the correct limit). I'd like to see the length be exposed as a parameter for rotation schedule so you can match it to the length you specified when creating the secret. This is related to a [CDK issue](https://github.com/aws/aws-cdk/issues/27608).

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the AWS::SecretsManager::RotationSchedule resource and its HostedRotationLambda property, then review the linked secret-generation and rotation documentation and the related CDK issue. Done means PasswordLength is exposed as a rotation-schedule parameter and the hosted rotation Lambda uses it while respecting the documented service limits.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.