Real-Time Alerts for AWS Secrets Manager Rotation Events

In today’s cloud environments, secrets like database passwords and API keys must be managed with care. AWS Secrets Manager makes rotation easy, but visibility is just as important. In this post, you’ll configure Amazon EventBridge and Amazon SNS to notify you whenever a secret rotation succeeds, and you’ll see how to automate the setup with Terraform.

Why this matters

• Reduced risk: frequent rotation limits the blast radius of leaked credentials.
• Fast detection: notifications let you respond quickly to unexpected rotations.
• Operational visibility: monitor whether rotations are happening reliably.

High-Level Architecture Diagram

Manual setup (console)

1) Create an SNS topic

1. Open Amazon SNS → Topics → Create topic.
2. Choose Standard.
3. Name it, e.g., SecretRotationTopic.
4. Create the topic.

2) Add email subscriptions

1. Open the topic you created.
2. Choose Create subscription.
3. Protocol: Email.
4. Enter your email address.
5. Confirm the subscription from the email you receive.
6. Repeat for additional email addresses.

3) Create an EventBridge rule

1. Open Amazon EventBridge → Rules → Create rule.
2. Name the rule, e.g., secrets-rotation-succeeded.
3. Event bus: default.
4. Select Custom pattern (JSON editor) and paste:

{
  "source": ["aws.secretsmanager"],
  "$or": [
    { "detail-type": ["AWS API Call via CloudTrail"] },
    { "detail-type": ["AWS Service Event via CloudTrail"] }
  ],
  "detail": {
    "eventSource": ["secretsmanager.amazonaws.com"],
    "eventName": ["RotationSucceeded"],
    "eventType": ["AwsServiceEvent"]
  }
}

Optional filter by specific secrets: add the following under detail:

"additionalEventData”: { 
    “SecretId”: [
        “arn:aws:secretsmanager:REGION:ACCOUNT:secret:YOUR-SECRET-ID”
    ] 
}

4) Add the SNS target

1. In Target, choose SNS topic.
2. Select your topic (SecretRotationTopic).
3. (Optional) Use a simple message template like:

"Secrets Manager rotation succeeded for <secret_id> at <time> (account <account>, region <region>, event <event_name>)."

1. Save the rule.

5) Attach an IAM role for EventBridge

If your organization requires a permissions boundary, create an IAM role with:

Trust policy (events.amazonaws.com):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "Service": "events.amazonaws.com" },
      "Action": "sts:AssumeRole"
    }
  ]
}

Permissions policy (SNS publish):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sns:Publish",
      "Resource": "arn:aws:sns:REGION:ACCOUNT:SecretRotationTopic"
    }
  ]
}

Attach the role to the EventBridge target.

Automate with Terraform

I’ve published a Terraform module that builds this end‑to‑end (SNS + EventBridge + IAM role + templates). You can find it here: mythun-engg/terraform-aws-notify-on-secret-rotation

A minimal usage snippet:

module "notify_on_secret_rotation" {
  source = "git::https://github.com/mythun-engg/terraform-aws-notify-on-secret-rotation.git?ref=0.0.1"

  topic_name = "secret-rotation-topic"

  email_subscriptions = [
    "security@example.com"
  ]

  secret_arns = [
    "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-abc123"
  ]
}

Final thoughts

Secrets rotation is only effective if you know it’s happening. Pairing AWS Secrets Manager with EventBridge and SNS gives you that visibility, and Terraform keeps it consistent across environmenīts.

If you have suggestions or improvements, feel free to reach out or open a PR.