aws.secretsmanager.rotate_secret

Call AWS Secrets Manager RotateSecret using a CloudConnection UUID.

Overview

Property	Value
Workflow type	Atomic
Library	Base-aws
Version	1.0

Input Schema

Field	Type	Required	Default	Description
organization_uuid	uuid	Yes	—	Authenticated organization UUID used for field resolution and connection scoping.
connection_uuid	uuid	Yes	—	AWS CloudConnection UUID for the target CodeArtifact account, scoped to the caller organization.
workflow_run_id	string	No	—	Engine DAG run ID stamped onto child steps.
region	string	No	—	AWS API endpoint region override; omit to use the connection or SDK default.
secret_id	string	Yes	—	<p>The ARN or name of the secret to rotate.</p> <p>For an ARN, we recommend that you specify a complete ARN rather than a partial ARN. See <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/troubleshoot.html#ARN_secretnamehyphen">Finding a secret from a partial ARN</a>.</p>
client_request_token	string	No	—	<p>A unique identifier for the new version of the secret. You only need to specify this value if you implement your own retry logic and you want to ensure that Secrets Manager doesn't attempt to create a secret version twice.</p> <note> <p>If you use the Amazon Web Services CLI or one of the Amazon Web Services SDKs to call this operation, then you can leave this parameter empty. The CLI or SDK generates a random UUID for you and includes it as the value for this parameter in the request. </p> </note> <p>If you generate a raw HTTP request to the Secrets Manager service endpoint, then you must generate a <code>ClientRequestToken</code> and include it in the request.</p> <p>This value helps ensure idempotency. Secrets Manager uses this value to prevent the accidental creation of duplicate versions if there are failures and retries during a rotation. We recommend that you generate a <a href="https://wikipedia.org/wiki/Universally_unique_identifier">UUID-type</a> value to ensure uniqueness of your versions within the specified secret. </p>
rotation_lambda_arn	string	No	—	<p>For secrets that use a Lambda rotation function to rotate, the ARN of the Lambda rotation function. </p> <p>For secrets that use <i>managed rotation</i>, omit this field. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_managed.html">Managed rotation</a> in the <i>Secrets Manager User Guide</i>.</p>
rotation_rules	json	No	—	<p>A structure that defines the rotation configuration for this secret.</p> <important> <p>When changing an existing rotation schedule and setting <code>RotateImmediately</code> to <code>false</code>:</p> <ul> <li> <p>If using <code>AutomaticallyAfterDays</code> or a <code>ScheduleExpression</code> with <code>rate()</code>, the previously scheduled rotation might still occur.</p> </li> <li> <p>To prevent unintended rotations, use a <code>ScheduleExpression</code> with <code>cron()</code> for granular control over rotation windows.</p> </li> </ul> </important>
external_secret_rotation_metadata	list	No	—	<p>The metadata needed to successfully rotate a managed external secret. A list of key value pairs in JSON format specified by the partner. For more information about the required information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/managed-external-secrets.html">Using Secrets Manager managed external secrets</a> </p>
external_secret_rotation_role_arn	string	No	—	<p>The Amazon Resource Name (ARN) of the role that allows Secrets Manager to rotate a secret held by a third-party partner. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/mes-security.html">Security and permissions</a>.</p>
rotate_immediately	boolean	No	—	<p>Specifies whether to rotate the secret immediately or wait until the next scheduled rotation window. The rotation schedule is defined in <a>RotateSecretRequest$RotationRules</a>.</p> <p>The default for <code>RotateImmediately</code> is <code>true</code>. If you don't specify this value, Secrets Manager rotates the secret immediately.</p> <p>If you set <code>RotateImmediately</code> to <code>false</code>, Secrets Manager tests the rotation configuration by running the <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_how.html"> <code>testSecret</code> step</a> of the Lambda rotation function. This test creates an <code>AWSPENDING</code> version of the secret and then removes it.</p> <p>When changing an existing rotation schedule and setting <code>RotateImmediately</code> to <code>false</code>:</p> <ul> <li> <p>If using <code>AutomaticallyAfterDays</code> or a <code>ScheduleExpression</code> with <code>rate()</code>, the previously scheduled rotation might still occur.</p> </li> <li> <p>To prevent unintended rotations, use a <code>ScheduleExpression</code> with <code>cron()</code> for granular control over rotation windows.</p> </li> </ul> <p>Rotation is an asynchronous process. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_how.html">How rotation works</a>.</p>
provider_native_request	json	No	—	Optional provider-native request overrides for AWS parameters not yet promoted to first-class fields.

Output Schema

Field	Type	Required	Default	Description
organization_uuid	uuid	No	—	Organization UUID echoed from input.
connection_uuid	uuid	No	—	AWS CloudConnection UUID echoed from input.
region	string	No	—	AWS API endpoint region used.
service	string	No	—	AWS boto3 service/client name.
operation	string	No	—	AWS API operation invoked.
request_id	string	No	—	AWS request ID when available.
response	json	No	—	Sanitized provider response object.
items	list	No	—	Primary response item list when the API returns a collection.
result_count	integer	No	—	Count of primary response items.
next_page_token	string	No	—	Pagination token for the next page.
failure_reason	string	No	—	Human-readable failure reason.
failed_step	string	No	—	Failed logical step.
failed_layer	json	No	—	Failed DAG layer if engine supplies one.
failed_at_state	string	No	—	State where failure occurred.
error	string	No	—	Error message.
error_type	string	No	—	Error class.
failed_at	string	No	—	ISO failure timestamp.

States

State	Initial	Terminal	Success	Auto-advance	Description
pending	Yes	No	—	execute	—
completed	No	Yes	Yes	—	—
failed	No	Yes	No	—	—

State Diagram

Transitions

From	Action	To	Description
pending	execute	completed	—
* (any state)	fail	failed	—

API Usage

POST /api/workflows/start
Content-Type: application/json

{
  "workflow_type": "aws.secretsmanager.rotate_secret",
  "initial_data": {
    "organization_uuid": "value",
    "connection_uuid": "value",
    "secret_id": "value"
  }
}