aws_secretsmanager: RotationSchedule cron expression support
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the feature
Secrets Manager and CloudFormation support using a cron schedule expression for secret rotation:
* https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_schedule.html#rotate-secrets_schedule-cron
* https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-rotationschedule-rotationrules.html
Maybe I'm missing it, but I cannot find equivalent functionality in CDK. It looks like only setting a rotation period is supported:
* https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.RotationSchedule.html
* https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.SecretRotation.html
* https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.RotationScheduleOptions.html
Request: Support cron schedule expressions in RotationSchedule, SecretRotation, and Secret#addRotationSchedule.
See: https://github.com/aws/aws-cdk/discussions/19980
### Use Case
I would like to control more precisely when secret rotation happens, and this functionality exists in the underlying service but is not exposed in CDK.
### Proposed Solution
Similar to the CloudFormation resource, a `schedule` property could be added to the relevant props interfaces alongside `automaticallyAfter`. The type of this property would be a flexible schedule object similar to `aws_events.Schedule`.
Unfortunately, this results in an awkward interface where one but not both of the `schedule` or `automaticallyAfter` properties is required. A better solution would be to have a single property that supports either rate or cron expression type. For example `automaticallyAfter` could accept `Duration | Schedule`. However then the name of that prop would be awkward. Unfortunately I can't think of a great way to express that interface in a backwards-compatible way. The ideal would be to just have a `schedule` property without `automaticallyAfter` but that would not be backwards-compatible.
### Other Information
Use `CfnRotationSchedule` L1 as a workaround. Unfortunately it requires manually setting up the permissions for the rotation function as well.
### Acknowledgements
- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change
### CDK version used
2.63.2
### Environment details (OS name and version, etc.)
macOS 12.6.1
Contributor guide
Research direction
Start with the RotationSchedule, SecretRotation, and Secret#addRotationSchedule entry points, then compare their automaticallyAfter handling with aws_events.Schedule and the CfnRotationSchedule workaround described in the issue. Define a backward-compatible way to expose cron schedules across these APIs, and verify that rate-based rotation remains supported while cron-based rotation produces the expected CloudFormation configuration.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100