feat(secretsmanager): add support for rotateImmediatelyOnUpdate for s…

…ecret rotation schedule (#25652) When adding a rotation schedule to a secret, you can specify whether or not the secret should be rotated immediately. This is optional, and by default, the secret will be rotated immediately if rotateImmediatelyOnUpdate is undefined. This PR exposes the rotateImmediatelyOnUpdate property enabling the user to configure this as false if they do not want the secret to be rotated immediately. Configuring this property as being explicitly true will result in the secret being rotated immediately, which is the default behavior. Closes #25365 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
aws · May 23, 2023 · cdafcc5 · cdafcc5
1 parent e724385
commit cdafcc5
Show file tree

Hide file tree

Showing 10 changed files with 93 additions and 36 deletions.
diff --git a/...nager/test/integ.hosted-rotation.js.snapshot/cdk-integ-secret-hosted-rotation.assets.json b/...nager/test/integ.hosted-rotation.js.snapshot/cdk-integ-secret-hosted-rotation.assets.json
@@ -1,15 +1,15 @@
 {
-  "version": "20.0.0",
+  "version": "31.0.0",
   "files": {
-    "80e7147ae17e29a7810c1890b8caa90a140f0089dcb2dce470bd13d88e5acc41": {
+    "68111103cf6a45cb34025acaab5488606270170cf3e4bccee5883433fe58e704": {
       "source": {
         "path": "cdk-integ-secret-hosted-rotation.template.json",
         "packaging": "file"
       },
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "80e7147ae17e29a7810c1890b8caa90a140f0089dcb2dce470bd13d88e5acc41.json",
+          "objectKey": "68111103cf6a45cb34025acaab5488606270170cf3e4bccee5883433fe58e704.json",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
         }
       }

diff --git a/...ger/test/integ.hosted-rotation.js.snapshot/cdk-integ-secret-hosted-rotation.template.json b/...ger/test/integ.hosted-rotation.js.snapshot/cdk-integ-secret-hosted-rotation.template.json
@@ -82,6 +82,7 @@
      "ExcludeCharacters": "&@/",
      "RotationType": "MySQLSingleUser"
     },
+    "RotateImmediatelyOnUpdate": false,
     "RotationRules": {
      "AutomaticallyAfterDays": 30
     }

diff --git a/...ng/framework-integ/test/aws-secretsmanager/test/integ.hosted-rotation.js.snapshot/cdk.out b/...ng/framework-integ/test/aws-secretsmanager/test/integ.hosted-rotation.js.snapshot/cdk.out
@@ -1 +1 @@
-{"version":"20.0.0"}
+{"version":"31.0.0"}
diff --git a/...framework-integ/test/aws-secretsmanager/test/integ.hosted-rotation.js.snapshot/integ.json b/...framework-integ/test/aws-secretsmanager/test/integ.hosted-rotation.js.snapshot/integ.json
@@ -1,5 +1,5 @@
 {
-  "version": "20.0.0",
+  "version": "31.0.0",
   "testCases": {
     "integ.hosted-rotation": {
       "stacks": [

diff --git a/...mework-integ/test/aws-secretsmanager/test/integ.hosted-rotation.js.snapshot/manifest.json b/...mework-integ/test/aws-secretsmanager/test/integ.hosted-rotation.js.snapshot/manifest.json
@@ -1,12 +1,6 @@
 {
-  "version": "20.0.0",
+  "version": "31.0.0",
   "artifacts": {
-    "Tree": {
-      "type": "cdk:tree",
-      "properties": {
-        "file": "tree.json"
-      }
-    },
     "cdk-integ-secret-hosted-rotation.assets": {
       "type": "cdk:asset-manifest",
       "properties": {
@@ -23,7 +17,7 @@
         "validateOnSynth": false,
         "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
         "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
-        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/80e7147ae17e29a7810c1890b8caa90a140f0089dcb2dce470bd13d88e5acc41.json",
+        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/68111103cf6a45cb34025acaab5488606270170cf3e4bccee5883433fe58e704.json",
         "requiresBootstrapStackVersion": 6,
         "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
         "additionalDependencies": [
@@ -89,6 +83,12 @@
         ]
       },
       "displayName": "cdk-integ-secret-hosted-rotation"
+    },
+    "Tree": {
+      "type": "cdk:tree",
+      "properties": {
+        "file": "tree.json"
+      }
     }
   }
 }
diff --git a/.../framework-integ/test/aws-secretsmanager/test/integ.hosted-rotation.js.snapshot/tree.json b/.../framework-integ/test/aws-secretsmanager/test/integ.hosted-rotation.js.snapshot/tree.json
@@ -4,14 +4,6 @@
     "id": "App",
     "path": "",
     "children": {
-      "Tree": {
-        "id": "Tree",
-        "path": "Tree",
-        "constructInfo": {
-          "fqn": "constructs.Construct",
-          "version": "10.1.85"
-        }
-      },
       "cdk-integ-secret-hosted-rotation": {
         "id": "cdk-integ-secret-hosted-rotation",
         "path": "cdk-integ-secret-hosted-rotation",
@@ -30,7 +22,7 @@
                   }
                 },
                 "constructInfo": {
-                  "fqn": "@aws-cdk/aws-secretsmanager.CfnSecret",
+                  "fqn": "aws-cdk-lib.aws_secretsmanager.CfnSecret",
                   "version": "0.0.0"
                 }
               },
@@ -57,13 +49,13 @@
                       }
                     },
                     "constructInfo": {
-                      "fqn": "@aws-cdk/aws-secretsmanager.CfnRotationSchedule",
+                      "fqn": "aws-cdk-lib.aws_secretsmanager.CfnRotationSchedule",
                       "version": "0.0.0"
                     }
                   }
                 },
                 "constructInfo": {
-                  "fqn": "@aws-cdk/aws-secretsmanager.RotationSchedule",
+                  "fqn": "aws-cdk-lib.aws_secretsmanager.RotationSchedule",
                   "version": "0.0.0"
                 }
               },
@@ -111,19 +103,19 @@
                       }
                     },
                     "constructInfo": {
-                      "fqn": "@aws-cdk/aws-secretsmanager.CfnResourcePolicy",
+                      "fqn": "aws-cdk-lib.aws_secretsmanager.CfnResourcePolicy",
                       "version": "0.0.0"
                     }
                   }
                 },
                 "constructInfo": {
-                  "fqn": "@aws-cdk/aws-secretsmanager.ResourcePolicy",
+                  "fqn": "aws-cdk-lib.aws_secretsmanager.ResourcePolicy",
                   "version": "0.0.0"
                 }
               }
             },
             "constructInfo": {
-              "fqn": "@aws-cdk/aws-secretsmanager.Secret",
+              "fqn": "aws-cdk-lib.aws_secretsmanager.Secret",
               "version": "0.0.0"
             }
           },
@@ -143,7 +135,7 @@
                   }
                 },
                 "constructInfo": {
-                  "fqn": "@aws-cdk/aws-secretsmanager.CfnSecret",
+                  "fqn": "aws-cdk-lib.aws_secretsmanager.CfnSecret",
                   "version": "0.0.0"
                 }
               },
@@ -164,19 +156,20 @@
                           "rotationType": "MySQLSingleUser",
                           "excludeCharacters": "&@/"
                         },
+                        "rotateImmediatelyOnUpdate": false,
                         "rotationRules": {
                           "automaticallyAfterDays": 30
                         }
                       }
                     },
                     "constructInfo": {
-                      "fqn": "@aws-cdk/aws-secretsmanager.CfnRotationSchedule",
+                      "fqn": "aws-cdk-lib.aws_secretsmanager.CfnRotationSchedule",
                       "version": "0.0.0"
                     }
                   }
                 },
                 "constructInfo": {
-                  "fqn": "@aws-cdk/aws-secretsmanager.RotationSchedule",
+                  "fqn": "aws-cdk-lib.aws_secretsmanager.RotationSchedule",
                   "version": "0.0.0"
                 }
               },
@@ -224,32 +217,56 @@
                       }
                     },
                     "constructInfo": {
-                      "fqn": "@aws-cdk/aws-secretsmanager.CfnResourcePolicy",
+                      "fqn": "aws-cdk-lib.aws_secretsmanager.CfnResourcePolicy",
                       "version": "0.0.0"
                     }
                   }
                 },
                 "constructInfo": {
-                  "fqn": "@aws-cdk/aws-secretsmanager.ResourcePolicy",
+                  "fqn": "aws-cdk-lib.aws_secretsmanager.ResourcePolicy",
                   "version": "0.0.0"
                 }
               }
             },
             "constructInfo": {
-              "fqn": "@aws-cdk/aws-secretsmanager.Secret",
+              "fqn": "aws-cdk-lib.aws_secretsmanager.Secret",
+              "version": "0.0.0"
+            }
+          },
+          "BootstrapVersion": {
+            "id": "BootstrapVersion",
+            "path": "cdk-integ-secret-hosted-rotation/BootstrapVersion",
+            "constructInfo": {
+              "fqn": "aws-cdk-lib.CfnParameter",
+              "version": "0.0.0"
+            }
+          },
+          "CheckBootstrapVersion": {
+            "id": "CheckBootstrapVersion",
+            "path": "cdk-integ-secret-hosted-rotation/CheckBootstrapVersion",
+            "constructInfo": {
+              "fqn": "aws-cdk-lib.CfnRule",
               "version": "0.0.0"
             }
           }
         },
+        "constructInfo": {
+          "fqn": "aws-cdk-lib.Stack",
+          "version": "0.0.0"
+        }
+      },
+      "Tree": {
+        "id": "Tree",
+        "path": "Tree",
         "constructInfo": {
           "fqn": "constructs.Construct",
-          "version": "10.1.85"
+          "version": "10.2.26"
         }
       }
     },
     "constructInfo": {
-      "fqn": "constructs.Construct",
-      "version": "10.1.85"
+      "fqn": "aws-cdk-lib.App",
+      "version": "0.0.0"
     }
   }
 }
diff --git a/...es/@aws-cdk-testing/framework-integ/test/aws-secretsmanager/test/integ.hosted-rotation.ts b/...es/@aws-cdk-testing/framework-integ/test/aws-secretsmanager/test/integ.hosted-rotation.ts
@@ -17,6 +17,7 @@ class TestStack extends cdk.Stack {
     });
     customSecret.addRotationSchedule('Schedule', {
       hostedRotation: secretsmanager.HostedRotation.mysqlSingleUser(),
+      rotateImmediatelyOnUpdate: false,
     });
   }
 }

diff --git a/packages/aws-cdk-lib/aws-secretsmanager/README.md b/packages/aws-cdk-lib/aws-secretsmanager/README.md
@@ -124,6 +124,7 @@ const secret = new secretsmanager.Secret(this, 'Secret');
 
 secret.addRotationSchedule('RotationSchedule', {
   hostedRotation: secretsmanager.HostedRotation.mysqlSingleUser(),
+  rotateImmediatelyOnUpdate: false, // by default, Secrets Manager rotates the secret immediately
 });
 ```
 

diff --git a/packages/aws-cdk-lib/aws-secretsmanager/lib/rotation-schedule.ts b/packages/aws-cdk-lib/aws-secretsmanager/lib/rotation-schedule.ts
@@ -42,6 +42,14 @@ export interface RotationScheduleOptions {
    * @default Duration.days(30)
    */
   readonly automaticallyAfter?: Duration;
+
+  /**
+   * Specifies whether to rotate the secret immediately or wait until the next
+   * scheduled rotation window.
+   *
+   * @default - secret is rotated immediately
+   */
+  readonly rotateImmediatelyOnUpdate?: boolean;
 }
 
 /**
@@ -132,6 +140,7 @@ export class RotationSchedule extends Resource {
       rotationLambdaArn: props.rotationLambda?.functionArn,
       hostedRotationLambda: props.hostedRotation?.bind(props.secret, this),
       rotationRules,
+      rotateImmediatelyOnUpdate: props.rotateImmediatelyOnUpdate,
     });
 
     // Prevent secrets deletions when rotation is in place

diff --git a/packages/aws-cdk-lib/aws-secretsmanager/test/rotation-schedule.test.ts b/packages/aws-cdk-lib/aws-secretsmanager/test/rotation-schedule.test.ts
@@ -43,6 +43,34 @@ test('create a rotation schedule with a rotation Lambda', () => {
   });
 });
 
+test('create a rotation schedule without immediate rotation', () => {
+  // GIVEN
+  const secret = new secretsmanager.Secret(stack, 'Secret');
+  const rotationLambda = new lambda.Function(stack, 'Lambda', {
+    runtime: lambda.Runtime.NODEJS_14_X,
+    code: lambda.Code.fromInline('export.handler = event => event;'),
+    handler: 'index.handler',
+  });
+
+  // WHEN
+  new secretsmanager.RotationSchedule(stack, 'RotationSchedule', {
+    secret,
+    rotationLambda,
+    rotateImmediatelyOnUpdate: false,
+  });
+
+  // THEN
+  Template.fromStack(stack).hasResourceProperties('AWS::SecretsManager::RotationSchedule', {
+    SecretId: {
+      Ref: 'SecretA720EF05',
+    },
+    RotationRules: {
+      AutomaticallyAfterDays: 30,
+    },
+    RotateImmediatelyOnUpdate: false,
+  });
+});
+
 test('assign permissions for rotation schedule with a rotation Lambda', () => {
   // GIVEN
   const secret = new secretsmanager.Secret(stack, 'Secret');