Habilidades aws-secrets-rotation
🔐

aws-secrets-rotation

Seguro

Automate AWS Secrets Rotation for RDS and API Keys

Manual secrets rotation is error-prone and often neglected. This skill provides production-ready Lambda functions and AWS CLI commands to automate credential rotation for databases and third-party services.

Soporta: Claude Codex Code(CC)
🥉 73 Bronce
1

Descargar el ZIP de la skill

2

Subir en Claude

Ve a Configuración → Capacidades → Skills → Subir skill

3

Activa y empieza a usar

Pruébalo

Usando "aws-secrets-rotation". Set up rotation for production RDS credentials

Resultado esperado:

Rotation enabled for prod/db/mysql with 30-day schedule. Lambda function arn:aws:lambda:us-east-1:123456789012:function:SecretsManagerRDSMySQLRotation will automatically rotate credentials. First rotation initiated.

Usando "aws-secrets-rotation". Audit all secrets for rotation compliance

Resultado esperado:

Compliant Secrets: 12
Non-Compliant Secrets: 3

Non-Compliant Details:
- dev/test/api-key: Rotation not enabled
- staging/db/postgres: Not rotated in 127 days
- legacy/service-token: Never rotated

Auditoría de seguridad

Seguro
v1 • 2/24/2026

All 70 static findings are false positives. The skill contains legitimate AWS CLI documentation, Lambda rotation code examples, and compliance tracking scripts. External command patterns are bash examples in markdown code blocks demonstrating AWS API usage. Network references are official AWS and Stripe API endpoints. No malicious patterns detected.

1
Archivos escaneados
466
Líneas analizadas
0
hallazgos
1
Auditorías totales
No se encontraron problemas de seguridad
Auditado por: claude

Puntuación de calidad

38
Arquitectura
100
Mantenibilidad
87
Contenido
50
Comunidad
100
Seguridad
83
Cumplimiento de la especificación

Lo que puedes crear

DevOps Engineer Automating Database Credential Rotation

Set up 30-day automatic rotation for production RDS MySQL credentials using AWS-managed Lambda templates with CloudWatch monitoring for rotation failures.

Security Team Implementing Compliance Requirements

Deploy rotation policies for all secrets, generate quarterly compliance reports showing rotation status, and configure alerts for overdue rotations.

Developer Rotating Third-Party API Keys

Create custom Lambda function to rotate Stripe API keys by calling their API, validating new keys, and revoking old credentials automatically.

Prueba estos prompts

Basic Secret Creation 
Create an AWS secret for my production MySQL database with username admin, host mydb.cluster-abc.us-east-1.rds.amazonaws.com, port 3306, and database myapp
Enable RDS Automatic Rotation 
Set up automatic rotation every 30 days for my RDS MySQL secret using the AWS-managed Lambda rotation function
Custom API Key Rotation 
Create a Lambda function that rotates Stripe API keys by calling the Stripe API to generate new keys, test them, and revoke old ones
Compliance Audit Report 
Generate a compliance report listing all secrets without rotation enabled and those not rotated in over 90 days

Mejores prácticas

  • Test rotation in non-production environments before deploying to production
  • Configure CloudWatch alarms to alert on rotation failures within 5 minutes
  • Maintain runbooks documenting emergency rotation procedures for compromised credentials

Evitar

  • Hardcoding secrets in application code instead of retrieving from Secrets Manager
  • Setting rotation intervals longer than 90 days for sensitive credentials
  • Rotating secrets without testing application compatibility first

Preguntas frecuentes

What AWS permissions are required to use this skill?
You need secretsmanager:CreateSecret, secretsmanager:GetSecretValue, secretsmanager:RotateSecret, secretsmanager:UpdateSecretVersionStage, lambda:InvokeFunction, and cloudwatch:PutMetricAlarm permissions.
Can this rotate secrets for non-AWS databases?
Yes, you can create custom Lambda functions for any database or service that supports programmatic credential rotation via API.
What happens if rotation fails?
The secret remains unchanged with the previous credentials. CloudWatch alarms can notify you of failures. The pending version is not promoted to current.
How do I rotate a secret immediately after a breach?
Use the rotate-secret command with --rotate-immediately flag to force rotation regardless of the scheduled interval.
Can applications access both old and new credentials during rotation?
Yes, AWS Secrets Manager supports multiple version stages (AWSPENDING, AWSCURRENT, AWSPREVIOUS) allowing gradual credential transitions.
Is there a cost for using automatic rotation?
Yes, you pay for Lambda invocations (approximately monthly per secret) plus Secrets Manager API calls. Rotation Lambda runs cost about $0.20-0.50 per secret per month.

Detalles del desarrollador

Autor

sickn33

Licencia

MIT

Repositorio

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/security/aws-secrets-rotation

Ref.

main

Estructura de archivos

📄 SKILL.md