What are so risks in removing or rotating a SecretsManager Secret vs KMS Key ?

Please consider below:

KMS Key Rotation

• Behavior: When you rotate a customer-managed KMS key, AWS generates new cryptographic material for the key. The old key material is retained, allowing decryption of data encrypted with the previous key version. This ensures backward compatibility and avoids service disruptions.

• Risks:

• If the key is deleted (not just rotated), any data encrypted with it becomes irretrievable unless you have a backup or a recovery plan.

• Applications must be configured to use the alias of the key rather than the specific key ID to ensure seamless transitions during rotation.

• Best Practices:

• Use automatic key rotation to simplify the process.

• Monitor key usage and ensure applications are updated to use the latest key version.

Secrets Manager Rotation Behavior: Secrets Manager rotation involves updating the secret's value (e.g., credentials) and synchronizing it with the service or application that uses it. Unlike KMS keys, Secrets Manager does not retain old versions for decryption purposes.

Risks:

• If the rotation process fails or is misconfigured, it can lead to service disruptions or application downtime.

• Applications must retrieve the updated secret value dynamically to avoid using stale credentials.

• Best Practices:

• Enable automatic rotation using AWS Secrets Manager's built-in functionality or a custom Lambda function.

• Test the rotation process thoroughly in a staging environment before applying it to production.

• Use versioning to manage secret updates and ensure applications are retrieving the latest version.

Key Differences

• KMS Key: Backward compatibility is maintained for decryption, making rotation relatively low-risk if configured correctly.

• Secrets Manager: Requires careful synchronization between the secret and the application to avoid disruptions.

Hello,

With respect to KMS, if automatic rotation is enabled, it occurs once every 1 year(default) or you can configure a custom interval. During the rotation process, a new cryptographic key material is created which is used to encrypt new data. However, the old cryptographic key material will remain available until the KMS key itself is deleted, thereby allowing you to decrypt previously encrypted data. To summarize, the ability to decrypt data which was encrypted with the old(rotated) key will remain.

Coming to AWS SecretsManager, the secret string that you store(API keys, database credentials, etc) is replaced/updated when you rotate or update the secret. The term "rotate" here means that you are changing the current value of the secret string. While AWS SecretsManager provides limited version control capabilities in the form of secret versions[2], the number of past versions that can be stored are limited. Only those secret versions that are associated with a label[2] are stored permanently. The maximum number of staging labels attached across all versions of a secret is 20.

Secrets Manager never removes labeled versions, but unlabelled versions are considered deprecated. Secrets Manager removes deprecated versions when there are more than 100. Secrets Manager doesn't remove versions created less than 24 hours ago[3]. If you'd like to store a past version of a secret, you may associate a custom label to it by using the API - UpdateSecretVersionStage[4].

To summarize rotation of a secret, you can still continue to store past versions of the secret, but you need to keep an eye on the number of deprecated versions not crossing 100. You also have the option of adding a custom label(20) to a past version(s) for easy retrieval/reference.

In terms of importance to past versions;

KMS : In a cryptographic sense, it is important to maintain access to past key materials so as to be able to decrypt previously encrypted data.

SecretsManager : The nature of secrets stored in SecretsManager should be such that the past versions are no longer required for application stability, e.g. old database password, API keys; needn't be stored once they are rotated out. However, you do have the option to store them in SecretsManager as well. Hence, there are no risks involved.

===============

References:

[1]. https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html

[2]. https://docs.aws.amazon.com/secretsmanager/latest/userguide/whats-in-a-secret.html#term_version

[3]. https://docs.aws.amazon.com/secretsmanager/latest/userguide/manage_update-secret-value.html#manage_update-secret-value_SDK

[4]. https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_UpdateSecretVersionStage.html