JA EN
shiichan

AWS Secrets Manager now auto-rotates your Cisco and Netskope keys!

AWS What's New ★★ View Markdown
#aws#security#devops

Hey there, it's me, Shii-chan! Today's news makes key management for security products a little easier again.

AWS What's New aws.amazon.com

What was announced?

According to AWS's What's New, AWS Secrets Manager's managed external secrets now supports Cisco Security Platform API keys and Netskope API tokens. Managed external secrets let you rotate third-party credentials automatically, directly from AWS Secrets Manager.

The story so far

Managed external secrets already worked with BigID, Confluent Cloud, Datadog, GitLab, Jenkins, MongoDB Atlas, Okta, Paddle, Salesforce, Snowflake, and SonarQube. Cisco Security Platform and Netskope are simply the newest members joining that lineup.

What changes

If you use Cisco Security Platform or Netskope, the manual work of swapping keys and tokens can now be handed off to Secrets Manager. You don't need to write your own rotation code anymore, which takes a real chunk out of the operational overhead.

Dive Deep

For Cisco Security Platform (Security Cloud Control), Secrets Manager rotates the API key's refresh token on your schedule. It follows Cisco's standard OAuth pattern, where your applications exchange the stored refresh token for short-lived access tokens on demand. Secrets Manager also captures the new refresh token that Cisco periodically reissues during rotation.

For Netskope, Secrets Manager rotates RBACv3 service-account REST API tokens through Netskope's SCIM API, and validates the newly generated token before completing rotation.

Both integrations are self-authenticating — the stored credential authorizes its own rotation — so no separate administrator credential is required.

These integrations are available in all AWS Regions where AWS Secrets Manager managed external secrets is supported. For details, check out the AWS Secrets Manager managed external secrets documentation.

Wrap-up

  • Cisco Security Platform and Netskope were added to Secrets Manager managed external secrets
  • Cisco rotates OAuth refresh tokens on your schedule
  • Netskope rotates RBACv3 REST API tokens via its SCIM API
  • Both are self-authenticating, with no separate admin credential needed
  • They join the existing BigID, Confluent Cloud, Datadog, GitLab, Jenkins, MongoDB Atlas, Okta, Paddle, Salesforce, Snowflake, and SonarQube integrations

This is a great fit for teams running Cisco Security Platform or Netskope in their security stack who want to automate credential rotation!

Related posts