Secrets Manager secrets unread for 90 days or more
What does ZopNight detect here?
Secrets Manager charges $0.40 per secret per month regardless of use, and AWS records a LastAccessedDate on every read. ZopNight fires only when that producer signal proves at least 90 days without access, and it refuses to nominate secrets whose names mark regulated credentials like KYC or UIDAI material.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-056 |
| Category | orphan |
| Severity | low |
| Metric | none — pure configuration read |
| Source | secrets_unused.go |
Where it applies
Measured non-use, not suspicion
This rule used to fire on existence and ask users to go verify: noise wearing a recommendation’s clothes. The current gate is a measurement: Secrets Manager stamps a last-accessed date whenever a secret is read, discovery carries it through (or a never-accessed marker plus the creation date), and the rule computes the unused age from that. Only 90+ proven days of silence fires; a secret with no access signal at all abstains, because unprovable is not the same as unused.
A compliance veto that overrides the math
Secrets whose names identify regulated credentials (KYC, Aadhaar, UIDAI, CKYC patterns) are never nominated, whatever their access history says. Two reasons stack: the $0.40 standing fee is trivial against the operational risk of deleting a regulated credential, and the access signal itself under-reports for exactly these secrets, which are often read at deploy time, during rotation, or cross-account in ways the day-granular timestamp can miss. A cheap saving with a catastrophic tail is not a saving.
Where the dollar figure comes from
Deleting a secret recovers its flat standing fee. When the pricing pipeline has a real per-secret cost it is used; when the lookup misses, the rule falls back to the published $0.40 per-secret monthly rate rather than shipping a $0 card. That is the one case in this family where a fixed public price stands in, because the fee genuinely is flat and deterministic.
Check the access dates yourself
aws secretsmanager list-secrets \ --query 'SecretList[].[Name,LastAccessedDate]' --output tableBlank dates on old secrets are the strongest candidates; confirm with
describe-secret per secret before acting.
Delete with the recovery window, always
Secrets Manager’s scheduled deletion holds the secret recoverable for 7 to 30 days. Take the window, never force immediate deletion. The classic failure is the quarterly or annual job whose credential looks months-dead in June and is desperately needed in January; the recovery window plus a calendar note covers the quarterly case, and a grep through IaC and CI configuration for the secret’s name covers the reference nobody remembered.