Rule to check if secrets are rotated every 90 days

ScoutSuite/providers/aws/rules/findings/secretsmanager-lack-of-secrets-rotation.json

@@ -0,0 +1,21 @@
+{
+    "description": "Lack of Secrets Rotation",
+    "rationale": "Rotating secrets can help you to reduce the risk of an unauthorized use of your secrets in your AWS account. Examples include database credentials, passwords, third-party API keys, and even arbitrary text. If you do not change your secrets for a long period of time, the secrets are more likely to be compromised.\n\nAs more users get access to a secret, it can become more likely that someone mishandled and leaked it to an unauthorized entity. Secrets can be leaked through logs and cache data. They can be shared for debugging purposes and not changed or revoked once the debugging completes. For all these reasons, secrets should be rotated frequently.",
+    "references": [
+        "https://docs.aws.amazon.com/console/securityhub/SecretsManager.4/remediation"
+    ],
+    "dashboard_name": "secrets",
+    "display_path": "secrets.secretsmanager.regions.id.secrets",
+    "path": "secretsmanager.regions.id.secrets.id",
+    "conditions": [
+        "and",
+        [
+            "secretsmanager.regions.id.secrets.id.last_changed_date",
+            "olderThan",
+            [
+                "90",
+                "days"
+            ]
+        ]
+    ]
+}

ScoutSuite/providers/aws/rules/rulesets/default.json

@@ -1161,6 +1161,12 @@
                 "level": "danger"
             }
         ],
+        "secretsmanager-lack-of-secrets-rotation.json": [
+            {
+                "enabled": false,
+                "level": "warning"
+            }
+        ],
         "ses-identity-dkim-not-enabled.json": [
             {
                 "enabled": true,

ScoutSuite/providers/aws/rules/rulesets/detailed.json

@@ -1190,6 +1190,12 @@
                 "level": "danger"
             }
         ],
+        "secretsmanager-lack-of-secrets-rotation.json": [
+            {
+                "enabled": false,
+                "level": "warning"
+            }
+        ],
         "ses-identity-dkim-not-enabled.json": [
             {
                 "enabled": true,