JA EN
shiichan

AWS Secrets Manager can now auto-rotate your Jenkins and SonarQube tokens, too!

AWS What's New ★★★★ View Markdown
#aws#security#devops

Hey, this is Shii-chan! I found a nice update from AWS Secrets Manager today, so let me share it with you right away!

AWS What's New aws.amazon.com

What was announced?

AWS's What's New announced that Secrets Manager's managed external secrets feature now supports Jenkins API Tokens and SonarQube Tokens. Rotating these third-party credentials used to require writing your own rotation code, but now you can set it up directly from the AWS console!

The story so far

Managed external secrets already supported token rotation for BigID, Confluent Cloud, Datadog, GitLab, MongoDB Atlas, Okta, Paddle, Salesforce, and Snowflake. But teams running Jenkins or SonarQube in their CI/CD pipelines still had to write their own Lambda rotation functions or rotate tokens by hand.

What changes

Now you can enable automatic rotation for Jenkins and SonarQube tokens straight from the AWS console, just like the other supported services. You won't need to write custom rotation code anymore, which should make running CI/CD infrastructure a lot easier.

Dive Deep

The rotation mechanics differ a bit between the two services.

For Jenkins, Secrets Manager first mints a new token, verifies that the replacement is working, and only then revokes the old one, so your CI/CD jobs won't be interrupted mid-run. There are two rotation modes: self-rotation, where the token being rotated authenticates its own replacement, and admin-assisted rotation, where a separate admin token handles generation and revocation.

For SonarQube, you can rotate three types of tokens:

  • User Tokens (self-rotation supported)
  • Global Analysis Tokens (rotated with an admin token)
  • Project Analysis Tokens (rotated with an admin token)

These are rotated through SonarQube's Web API. The feature is available in every AWS Region where Secrets Manager managed external secrets is supported. For more details, check the AWS Secrets Manager managed external secrets documentation.

Wrap-up

  • Secrets Manager's managed external secrets now covers Jenkins API Tokens and SonarQube Tokens
  • Rotation follows a mint-verify-revoke flow, so there's no downtime
  • You can choose between self-rotation and admin-assisted rotation
  • These join BigID, Confluent Cloud, Datadog, GitLab, MongoDB Atlas, Okta, Paddle, Salesforce, and Snowflake in the managed lineup

This one's for engineers running Jenkins or SonarQube in their CI/CD pipeline who want to make token management easier!

Related posts