class

CRE::Rotators::AwsSecretsRotator

Inherits CRE::Rotators::Rotator < Reference < Object

AwsSecretsRotator implements the 4-step rotation contract against AWS Secrets Manager, mirroring the standard Rotation Lambda template:

  1. generate -> PutSecretValue with AWSPENDING label, returns version_id
  2. apply -> no-op (PutSecretValue exposed it; AWSPENDING already attached)
  3. verify -> GetSecretValue by version_id, confirm decoded value matches
  4. commit -> UpdateSecretVersionStage move AWSCURRENT to new, AWSPREVIOUS to old rollback_apply -> remove AWSPENDING stage from the new version

Required Credential.tags: "secret_arn" - the AWS Secrets Manager ARN or name "value_length" - optional, bytes of random payload (default 32)

Constants

DEFAULT_BYTES = 32

Constructors

new(client : Aws::SecretsManagerClient)
Source

Instance methods

apply(c : Domain::Credential, s : Domain::NewSecret) : Nil
Source
can_rotate?(c : Domain::Credential) : Bool
Source
commit(c : Domain::Credential, s : Domain::NewSecret) : Nil
Source
generate(c : Domain::Credential) : Domain::NewSecret
Source
kind
Source
rollback_apply(c : Domain::Credential, s : Domain::NewSecret) : Nil

Default no-op; rotators override when apply() creates reversible side effects.

Source
verify(c : Domain::Credential, s : Domain::NewSecret) : Bool
Source