Schedule expressions in Secrets Manager rotation
When you turn on automatic rotation, you can use a cron() or rate() expression to set the schedule for rotating your secret. With a rate expression, you can create a rotation schedule that repeats on an interval of hours or days. With a cron expression, you can create rotation schedules that are more detailed than a rotation interval. Secrets Manager rotation schedules use UTC time zone. You can rotate a secret as often as every four hours. Secrets Manager rotates your secret at any time during the rotation window.
To turn on rotation, see:
Rate expressions
Secrets Manager rate expressions have the following format, where
Value
is a positive integer and
Unit
can be hour
, hours
, day
, or days
:
rate(
Value
Unit
)
You can rotate a secret as often as every four hours. Examples:
rate(4 hours)
means the secret is rotated every four hours.rate(1 day)
means the secret is rotated every day.rate(10 days)
means the secret is rotated every 10 days.
For a rate in hours, the default rotation window starts at midnight and closes after one hour. You can set the Window duration to change the rotation window. The rotation window must not extend into the next rotation window. One way to check this is to confirm that the rotation window is less than or equal to the number of hours between rotations.
For a rate in days, the default rotation window starts at midnight and closes at the end of the day. You can set the Window duration to change the rotation window. The rotation window must not extend into the next UTC day. One way to check this is to confirm that the start hour plus the window duration is less than or equal to 24 hours.
Cron expressions
Cron expressions have the following format:
cron(
Minutes
Hours
Day-of-month
Month
Day-of-week
Year
)
A cron expression that includes increments of hours resets each day. For example, cron(0 4/12 * * ? *)
means 4:00 AM, 4:00 PM, and then the next day 4:00 AM, 4:00 PM. Secrets Manager rotation schedules use UTC time zone.
For a schedule in hours, the default rotation window closes after one hour. You can set the Window duration to change the rotation window. The rotation window must not go into the next rotation window.
Example schedule | Expression |
---|---|
Every eight hours starting at midnight. |
|
Every eight hours starting at 8:00 AM. |
|
Every ten hours, starting at 2:00 AM. The rotation windows will start at 2:00, 12:00, and 22:00, and then the next day at 2:00, 12:00, and 22:00. |
|
Every day at 10:00 AM. |
|
Every Saturday at 6:00 PM. |
|
The first day of every month at 8:00 AM. |
|
Every three months on the first Sunday at 1:00 AM. |
|
The last day of every month at 5:00 PM. |
|
Monday through Friday at 8:00 AM. |
|
First and 15th day of every month at 4:00 PM. |
|
First Sunday of every month at midnight. |
|
Cron expression requirements in Secrets Manager
Secrets Manager has some restrictions on what you can use for cron expressions. A cron expression for Secrets Manager must have 0 in the minutes field because Secrets Manager rotation windows start on the hour. It must have * in the year field, because Secrets Manager does not support rotation schedules that are more than a year apart. The following table shows the options you can use.
Fields | Values | Wildcards |
---|---|---|
Minutes |
Must be 0 | None |
Hours |
0–23 |
Use / (forward slash) to specify increments. For example |
Day-of-month |
1–31 |
Use , (comma) to include additional values. For example Use - (dash) to specify a range. For example Use * (asterisk) to includes all values in the
field. For example The ? (question mark) wildcard specifies one or another.
You can't specify the Use / (forward slash) to specify increments. For example, Use L to specify the last day of the month. Use |
Month |
1–12 or JAN–DEC |
Use , (comma) to include additional values. For example, Use - (dash) to specify a range. For example Use * (asterisk) to includes all values in the
field. For example Use / (forward slash) to specify increments. For example, |
Day-of-week |
1–7 or SUN–SAT |
Use # to
specify the day of the week within a month. For example, Use , (comma) to include additional values. For example Use - (dash) to specify a range. For example Use * (asterisk) to includes all values in the
field. For example The ? (question mark) wildcard specifies one or another.
You can't specify the Use / (forward slash) to specify increments. For example, Use L to specify the last day of the week. |
Year |
Must be * |
None |