aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
Allow AWS::SecretsManager::Secret grace period
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::SecretsManager::Secret
### Resource name
_No response_
### Description
Currently the default deletionpolicy for an `AWS::SecretsManager::Secret` resource is force-delete-without-recovery [1].
This means that the deletion "grace period" [2] cannot be used when managing your secrets via CFN. This functionality is inconsistent with other resources types, such as `AWS::KMS::Key` which allows a grace period (via pending window) and provides a property for customizing the duration.
I understand that CFN needs to force delete the secret to avoid lingering artifacts after stack termination, the same requirement however does not appear to apply to the KMS key. Therefore, a possible solution would be to update the CFN resource handler for `AWS::SecretsManager::Secret` to not force delete the secret on resource termination, and instead export the resource at resource termination.
Issues this solution may cause:
1. Naming conflicts from recently deleted resources/stacks and their secret names
2. Potential security impact of changing the default behavior, which would now allow secrets to be recovered after stack deletion
Interested to hear your thoughts.
[1] https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html
[2] https://docs.aws.amazon.com/secretsmanager/latest/userguide/manage_delete-secret.html
[3] https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-kms-key.html#cfn-kms-key-pendingwindowindays
### Other Details
_No response_
Contributor guide
Research direction
Start with the CloudFormation DeletionPolicy documentation and the Secrets Manager deletion-grace-period documentation linked in the issue, then compare the AWS::KMS::Key pending-window behavior. Review the proposed resource-handler change and its naming-conflict and security implications; done requires an agreed scope and acceptance criteria for supporting recovery after stack deletion.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100