java.lang.Object
- com.pulumi.resources.Resource
- - com.pulumi.resources.CustomResource
  - - com.pulumi.aws.secretsmanager.SecretRotation

public class SecretRotation
extends com.pulumi.resources.CustomResource

Provides a resource to manage AWS Secrets Manager secret rotation. To manage a secret, see the `aws.secretsmanager.Secret` resource. To manage a secret value, see the `aws.secretsmanager.SecretVersion` resource. ## Example Usage ### Basic

 
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.secretsmanager.SecretRotation;
 import com.pulumi.aws.secretsmanager.SecretRotationArgs;
 import com.pulumi.aws.secretsmanager.inputs.SecretRotationRotationRulesArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var example = new SecretRotation("example", SecretRotationArgs.builder()
             .rotationRules(SecretRotationRotationRulesArgs.builder()
                 .automaticallyAfterDays(30)
                 .build())
             .secretId(exampleAwsSecretsmanagerSecret.id())
             .rotationLambdaArn(exampleAwsLambdaFunction.arn())
             .build());
 
     }
 }

### Managed External Secret Rotation For managed external secrets that are rotated by AWS partner integrations:

 
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.secretsmanager.Secret;
 import com.pulumi.aws.secretsmanager.SecretArgs;
 import com.pulumi.aws.secretsmanager.SecretRotation;
 import com.pulumi.aws.secretsmanager.SecretRotationArgs;
 import com.pulumi.aws.secretsmanager.inputs.SecretRotationRotationRulesArgs;
 import com.pulumi.aws.secretsmanager.inputs.SecretRotationExternalSecretRotationMetadataArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var example = new Secret("example", SecretArgs.builder()
             .name("example-salesforce-client-secret")
             .type("SalesforceClientSecret")
             .build());
 
         var exampleSecretRotation = new SecretRotation("exampleSecretRotation", SecretRotationArgs.builder()
             .rotationRules(SecretRotationRotationRulesArgs.builder()
                 .automaticallyAfterDays(rotationDays)
                 .build())
             .externalSecretRotationMetadatas(            
                 SecretRotationExternalSecretRotationMetadataArgs.builder()
                     .key("adminSecretArn")
                     .value(example.arn())
                     .build(),
                 SecretRotationExternalSecretRotationMetadataArgs.builder()
                     .key("apiVersion")
                     .value("v65.0")
                     .build())
             .secretId(example.id())
             .externalSecretRotationRoleArn(exampleAwsIamRole.arn())
             .build());
 
     }
 }

For more information about managed external secrets and partner-specific metadata requirements, see the [AWS documentation](https://docs.aws.amazon.com/secretsmanager/latest/userguide/managed-external-secrets.html) and [partner-specific guides](https://docs.aws.amazon.com/secretsmanager/latest/userguide/mes-partners.html). ### Disable Rotation for a Managed Secret When a secret is managed by AWS, such as an RDS master user password secret created via `manageMasterUserPassword`, rotation is enabled automatically. Set `rotationEnabled` to `false` (and omit `rotationRules`) to turn that rotation off:

 
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.rds.Instance;
 import com.pulumi.aws.rds.InstanceArgs;
 import com.pulumi.aws.secretsmanager.SecretRotation;
 import com.pulumi.aws.secretsmanager.SecretRotationArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var example = new Instance("example", InstanceArgs.builder()
             .manageMasterUserPassword(true)
             .build());
 
         var exampleSecretRotation = new SecretRotation("exampleSecretRotation", SecretRotationArgs.builder()
             .secretId(example.masterUserSecrets().applyValue(_masterUserSecrets -> _masterUserSecrets[0].secretArn()))
             .rotationEnabled(false)
             .build());
 
     }
 }

> **NOTE:** For Amazon Aurora and other clustered engines, rotation is finalized once a cluster instance is available, and AWS re-enables rotation if it is cancelled before then. Ensure this resource depends on the cluster instance (for example, with `dependsOn = [aws_rds_cluster_instance.example]`) so the cancellation is applied after the instance is available. When `rotationEnabled` is `false`, `rotationRules` must be omitted. If you toggle rotation on and off through a variable (for example, in a module), gate the block with a `dynamic` block so it is only present when rotation is enabled: ### Rotation Configuration To enable automatic secret rotation, the Secrets Manager service requires usage of a Lambda function. The [Rotate Secrets section in the Secrets Manager User Guide](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html) provides additional information about deploying a prebuilt Lambda functions for supported credential rotation (e.g., RDS) or deploying a custom Lambda function. > **NOTE:** Configuring rotation causes the secret to rotate once as soon as you enable rotation. Before you do this, you must ensure that all of your applications that use the credentials stored in the secret are updated to retrieve the secret from AWS Secrets Manager. The old credentials might no longer be usable after the initial rotation and any applications that you fail to update will break as soon as the old credentials are no longer valid. > **NOTE:** If you cancel a rotation that is in progress (by removing the `rotation` configuration), it can leave the VersionStage labels in an unexpected state. Depending on what step of the rotation was in progress, you might need to remove the staging label AWSPENDING from the partially created version, specified by the SecretVersionId response value. You should also evaluate the partially rotated new version to see if it should be deleted, which you can do by removing all staging labels from the new version's VersionStage field. ## Import ### Identity Schema #### Required - `secretId` (String) ARN of the Secrets Manager secret. Using `pulumi import`, import `aws.secretsmanager.SecretRotation` using the secret ARN. For example: ```sh $ pulumi import aws:secretsmanager/secretRotation:SecretRotation example arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456 ```

Nested Class Summary
- Nested classes/interfaces inherited from class com.pulumi.resources.CustomResource
  com.pulumi.resources.CustomResource.CustomResourceInternal
- Nested classes/interfaces inherited from class com.pulumi.resources.Resource
  com.pulumi.resources.Resource.LazyField<T extends java.lang.Object>, com.pulumi.resources.Resource.LazyFields, com.pulumi.resources.Resource.ResourceInternal

Field Summary
- Fields inherited from class com.pulumi.resources.Resource
  childResources, remote

Constructor Summary

Constructors
Constructor	Description
`SecretRotation(java.lang.String name)`
`SecretRotation(java.lang.String name, SecretRotationArgs args)`
`SecretRotation(java.lang.String name, SecretRotationArgs args, com.pulumi.resources.CustomResourceOptions options)`

Method Summary

All Methods Static Methods Instance Methods Concrete Methods
Modifier and Type	Method	Description
`com.pulumi.core.Output<java.util.Optional<java.util.List<SecretRotationExternalSecretRotationMetadata>>>`	`externalSecretRotationMetadatas()`
`com.pulumi.core.Output<java.util.Optional<java.lang.String>>`	`externalSecretRotationRoleArn()`
`static SecretRotation`	`get(java.lang.String name, com.pulumi.core.Output<java.lang.String> id, SecretRotationState state, com.pulumi.resources.CustomResourceOptions options)`	Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
`com.pulumi.core.Output<java.lang.String>`	`region()`
`com.pulumi.core.Output<java.util.Optional<java.lang.Boolean>>`	`rotateImmediately()`
`com.pulumi.core.Output<java.lang.Boolean>`	`rotationEnabled()`
`com.pulumi.core.Output<java.util.Optional<java.lang.String>>`	`rotationLambdaArn()`
`com.pulumi.core.Output<java.util.Optional<SecretRotationRotationRules>>`	`rotationRules()`
`com.pulumi.core.Output<java.lang.String>`	`secretId()`

Methods inherited from class com.pulumi.resources.CustomResource
getId, id, idFuture

Methods inherited from class com.pulumi.resources.Resource
getChildResources, getResourceName, getResourceType, getUrn, pulumiChildResources, pulumiResourceName, pulumiResourceType, urn

Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

- Constructor Detail
  - SecretRotation
```
public SecretRotation(java.lang.String name)
```
    Parameters:
    
    name - The _unique_ name of the resulting resource.
  - SecretRotation
```
public SecretRotation(java.lang.String name,
                      SecretRotationArgs args)
```
    Parameters:
    
    name - The _unique_ name of the resulting resource.
    
    args - The arguments to use to populate this resource's properties.
  - SecretRotation
```
public SecretRotation(java.lang.String name,
                      SecretRotationArgs args,
                      @Nullable
                      com.pulumi.resources.CustomResourceOptions options)
```
    Parameters:
    
    name - The _unique_ name of the resulting resource.
    
    args - The arguments to use to populate this resource's properties.
    
    options - A bag of options that control this resource's behavior.
- Method Detail
  - externalSecretRotationMetadatas
```
public com.pulumi.core.Output<java.util.Optional<java.util.List<SecretRotationExternalSecretRotationMetadata>>> externalSecretRotationMetadatas()
```
    Returns:
    
    Configuration block for metadata required by the external secret partner. Required for managed external secrets. See details below.
  - externalSecretRotationRoleArn
```
public com.pulumi.core.Output<java.util.Optional<java.lang.String>> externalSecretRotationRoleArn()
```
    Returns:
    
    ARN of the IAM role that allows Secrets Manager to rotate the secret held by a third-party partner. Required for managed external secrets.
  - region
```
public com.pulumi.core.Output<java.lang.String> region()
```
    Returns:
    
    Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
  - rotateImmediately
```
public com.pulumi.core.Output<java.util.Optional<java.lang.Boolean>> rotateImmediately()
```
    Returns:
    
    Whether to rotate the secret immediately or wait until the next scheduled rotation window. The rotation schedule is defined in `rotationRules`. For secrets that use a Lambda rotation function to rotate, if you don't immediately rotate the secret, Secrets Manager tests the rotation configuration by running the testSecret step (https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_how.html) of the Lambda rotation function. The test creates an AWSPENDING version of the secret and then removes it. Defaults to `true`.
  - rotationEnabled
```
public com.pulumi.core.Output<java.lang.Boolean> rotationEnabled()
```
    Returns:
    
    Whether automatic rotation is enabled for the secret. Set to `false` to disable rotation on a secret whose rotation is otherwise managed by AWS (for example, an RDS master user password secret). When `false`, `rotationRules` must be omitted. Defaults to enabled when `rotationRules` is configured. Destroying this resource does not re-enable the automatic rotation that AWS configured.
  - rotationLambdaArn
```
public com.pulumi.core.Output<java.util.Optional<java.lang.String>> rotationLambdaArn()
```
    Returns:
    
    ARN of the Lambda function that can rotate the secret. Must be supplied if the secret is not managed by AWS.
  - rotationRules
```
public com.pulumi.core.Output<java.util.Optional<SecretRotationRotationRules>> rotationRules()
```
    Returns:
    
    Structure that defines the rotation configuration for this secret. Required unless `rotationEnabled` is `false`. Defined below.
  - secretId
```
public com.pulumi.core.Output<java.lang.String> secretId()
```
    Returns:
    
    Secret to which you want to add a new version. You can specify either the ARN or the friendly name of the secret. The secret must already exist.
  - get
```
public static SecretRotation get(java.lang.String name,
                                 com.pulumi.core.Output<java.lang.String> id,
                                 @Nullable
                                 SecretRotationState state,
                                 @Nullable
                                 com.pulumi.resources.CustomResourceOptions options)
```
    Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
    
    Parameters:
    
    name - The _unique_ name of the resulting resource.
    
    id - The _unique_ provider ID of the resource to lookup.
    
    state -
    
    options - Optional settings to control the behavior of the CustomResource.

Class SecretRotation

Nested Class Summary

Nested classes/interfaces inherited from class com.pulumi.resources.CustomResource

Nested classes/interfaces inherited from class com.pulumi.resources.Resource

Field Summary

Fields inherited from class com.pulumi.resources.Resource

Constructor Summary

Method Summary

Methods inherited from class com.pulumi.resources.CustomResource

Methods inherited from class com.pulumi.resources.Resource

Methods inherited from class java.lang.Object

Constructor Detail

SecretRotation

SecretRotation

SecretRotation

Method Detail

externalSecretRotationMetadatas

externalSecretRotationRoleArn

region

rotateImmediately

rotationEnabled

rotationLambdaArn

rotationRules

secretId

get