Policy: AWS > Secrets Manager > Secret > Rotation > Schedule Expression

Defines the schedule at which to rotate the secret. This policy supports two formats:

- Rate expressions: Define regular intervals for secret rotation, such as: - rate(4 hours) — Rotates every 4 hours (minimum allowed). - rate(7 days) — Rotates once every 7 days. - Allowed values: - Hours: 4 to 23 - Days: 1 to 999

- Cron expressions: Use AWS cron format: cron(Minutes Hours Day-of-month Month Day-of-week Year) - Examples: - cron(0 8/8 * * ? *) — Every 8 hours starting at 8:00 AM UTC. - cron(0 2/10 * * ? *) — Every 10 hours starting at 2:00 AM UTC. - cron(0 8 1/7 * ? *) — Every 7 days starting from the 1st of the month at 8:00 AM UTC. - cron(0 0 ? * SUN#1 *) — First Sunday of every month at midnight. - cron(0 16 L * ? *) — On the last day of every month at 4:00 PM UTC.

See Rotation schedules for more details.

Targets

This policy targets the following resource types:

AWS > Secrets Manager > Secret

Primary Policy

This policy is used with the following primary policy:

AWS > Secrets Manager > Secret > Rotation

Controls

Setting this policy configures this control:

AWS > Secrets Manager > Secret > Rotation

Policy Specification

Schema Type	`string`
Default template	`{{ $.resource.scheduleExpression }}`
Default template input	`\| { resource { scheduleExpression: get(path: "RotationRules.ScheduleExpression") } }`
Examples [YAML]	`rate(4 hours)` `rate(1 day)` `rate(7 days)` `rate(30 days)` `cron(0 8/8 * * ? )` `cron(0 2/10 * ? )` `cron(0 8 1/7 ? )` `cron(0 0 ? SUN#1 )` `cron(0 16 L ? *)`

In Your Workspace

Policy Settings by Type report

Developers

Category URI

tmod:@turbot/turbot#/control/categories/security

Policy Type URI

tmod:@turbot/aws-secretsmanager#/policy/types/secretRotationScheduleExpression

GraphQL

query policyType(id: "tmod:@turbot/aws-secretsmanager#/policy/types/secretRotationScheduleExpression") { … }

query policySettings(filter: "policyTypeId:'tmod:@turbot/aws-secretsmanager#/policy/types/secretRotationScheduleExpression'") { … }

query policyValues(filter: "policyTypeId:'tmod:@turbot/aws-secretsmanager#/policy/types/secretRotationScheduleExpression'") { … }

CLI

Get Policy Type

turbot graphql policy-type --id "tmod:@turbot/aws-secretsmanager#/policy/types/secretRotationScheduleExpression"

Get Policy Settings

turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/aws-secretsmanager#/policy/types/secretRotationScheduleExpression"