aws / aws/aws-cdk

aws_secretsmanager: RotationSchedule cron expression support

Open
#24,062 5 comments 22 reactions 0 assignees View on GitHub
@aws-cdk/aws-secretsmanager feature-request p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the feature

Secrets Manager and CloudFormation support using a cron schedule expression for secret rotation:

* https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_schedule.html#rotate-secrets_schedule-cron
* https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-rotationschedule-rotationrules.html

Maybe I'm missing it, but I cannot find equivalent functionality in CDK. It looks like only setting a rotation period is supported:

* https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.RotationSchedule.html
* https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.SecretRotation.html
* https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.RotationScheduleOptions.html

Request: Support cron schedule expressions in RotationSchedule, SecretRotation, and Secret#addRotationSchedule.

See: https://github.com/aws/aws-cdk/discussions/19980

### Use Case

I would like to control more precisely when secret rotation happens, and this functionality exists in the underlying service but is not exposed in CDK.

### Proposed Solution

Similar to the CloudFormation resource, a `schedule` property could be added to the relevant props interfaces alongside `automaticallyAfter`. The type of this property would be a flexible schedule object similar to `aws_events.Schedule`.

Unfortunately, this results in an awkward interface where one but not both of the `schedule` or `automaticallyAfter` properties is required. A better solution would be to have a single property that supports either rate or cron expression type. For example `automaticallyAfter` could accept `Duration | Schedule`. However then the name of that prop would be awkward. Unfortunately I can't think of a great way to express that interface in a backwards-compatible way. The ideal would be to just have a `schedule` property without `automaticallyAfter` but that would not be backwards-compatible.

### Other Information

Use `CfnRotationSchedule` L1 as a workaround. Unfortunately it requires manually setting up the permissions for the rotation function as well.

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.63.2

### Environment details (OS name and version, etc.)

macOS 12.6.1

Contributor guide

Open the contributing guide

Research direction

Start with the RotationSchedule, SecretRotation, and Secret#addRotationSchedule entry points, then compare their automaticallyAfter handling with aws_events.Schedule and the CfnRotationSchedule workaround described in the issue. Define a backward-compatible way to expose cron schedules across these APIs, and verify that rate-based rotation remains supported while cron-based rotation produces the expected CloudFormation configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.