aws / aws/aws-cdk

(aws_secretsmanager): automaticallyAfter is not disabling the automatic rotation of secrets

Open
#27,460 10 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-secretsmanager bug effort/medium p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

As per doc, if the property automaticallyAfter is set to Duration.days(0) then it should disable automatic rotation, however it is removing the property

```
RotationRules:
AutomaticallyAfterDays: 365
```
from the resource AWS::SecretsManager::RotationSchedule

### Expected Behavior

The resource AWS::SecretsManager::RotationSchedule completely removed from the stack template which will make the call API [CancelRotateSecret](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_CancelRotateSecret.html)

### Current Behavior

It is removing the below property which is not making any change in the secret's rotation.

```
RotationRules:
AutomaticallyAfterDays: 365
```

### Reproduction Steps

```
secret_test = secretsmanager.Secret(self, "Secret",
secret_object_value={
"username": cdk.SecretValue.unsafe_plain_text("foo"),
"database": cdk.SecretValue.unsafe_plain_text("foo"),
}
)

rotation_fn = _lambda.Function(self, 'RotationFN', runtime=_lambda.Runtime.PYTHON_3_9,
handler='index.handler', code=_lambda.Code.from_inline("hello world"))

secret_test.add_rotation_schedule(
"SecretRotation", automatically_after=cdk.Duration.days(0), rotate_immediately_on_update=False, rotation_lambda=rotation_fn)
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.97.1

### Framework Version

_No response_

### Node.js Version

20.7.0

### OS

macos

### Language

Python

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the Secret.add_rotation_schedule call shown in the reproduction and synthesize the stack using automatically_after set to Duration.days(0). Compare the generated AWS::SecretsManager::RotationSchedule with the expected behavior: the resource should be removed so CancelRotateSecret can disable rotation.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.