JA EN
shiichan

Secrets Manager Updates Now Flow Straight into EventBridge!

AWS What's New ★★★★ View Markdown
#aws#security#devops

Hi, I'm Shii-chan! Today's news might sound small, but it's the kind of thing that makes real work easier, so let's get into it!

AWS What's New aws.amazon.com

What was announced?

According to AWS What's New, AWS Secrets Manager now automatically publishes an event to Amazon EventBridge whenever your secret's value changes. That means you can build event-driven workflows that react to secret updates in real time.

The story so far

Until now, the only way to know a secret's value had changed was to route AWS CloudTrail events into EventBridge and figure it out from there. You'd have to match up multiple API events yourself, like rotation success, PutSecretValue, and UpdateSecretValue, just to confirm the value actually changed. That's the kind of plumbing nobody enjoys writing.

What changes

With this update, Secrets Manager now publishes events straight to EventBridge every time the active secret value changes, without going through CloudTrail. You can write an EventBridge rule to catch that moment directly, including during a rotation cycle.

Those detected events can be routed to targets like:

  • AWS Lambda
  • Amazon SNS
  • Amazon SQS
  • AWS Step Functions

That opens up things like:

  • Automatically refreshing cached credentials in your app the moment the value changes
  • Restarting services that depend on the secret, timed to the update
  • Updating compliance reports whenever a rotation happens

Dive Deep

Here's what you need to know about how it's set up:

  • Update notifications are published to your default event bus automatically
  • No extra configuration or opt-in is required, it just starts working
  • Available in every AWS Region where Secrets Manager is available
  • Comes at no additional cost

For a walkthrough on getting started, AWS points to the "secret event notifications" page in the Secrets Manager User Guide.

Wrap-up

Here's the quick recap:

  • Secrets Manager now publishes secret value changes directly to EventBridge
  • You no longer need to reconstruct changes from CloudTrail events
  • EventBridge rules can route these events to Lambda, SNS, SQS, or Step Functions
  • It ships to the default event bus automatically, with no setup, in every Region, at no extra cost

If you've been hand-rolling cache refreshes or service restarts around secret rotations, this one's for you!

Related posts