Skip to content
Spacelift Flows

Secret Rotation Orchestrator

← Back to gallery

Secret Rotation Orchestrator

ReliabilityAWS API - Secrets ManagerPagerDutySlackSpacelift

This Flow automates the full credential rotation lifecycle. On a monthly schedule it fetches the current secret version from AWS Secrets Manager, generates a strong replacement with the Secrets Manager API, and stores it as the new current version - the old one stays available as AWSPREVIOUS for rollback. The new credential is pushed to the consuming Spacelift stack as a write-only environment variable, and the Flow then triggers a run on that stack: a finished run is the proof that consumers actually work with the new credential. A successful rotation is recorded in the rotation-history data table and announced in Slack. If the verification run fails, or anything breaks after the new version was stored, the Flow moves the secret back to the previous version, restores the old value on the stack, opens a PagerDuty incident, records the rolled-back rotation, and alerts Slack. Failures where rollback is not applicable - or where the rollback itself failed - skip straight to alerting and are flagged for manual intervention.

After importing, connect the Flow to your systems: give the AWS Secrets Manager installation credentials that can read and write the rotated secret (plus secretsmanager:GetRandomPassword, which is not resource-scoped), point the secret ID and region fields at your secret, set the Spacelift stack ID on the update, restore, and verification blocks, fill in the PagerDuty service ID and from-email, and create a SLACK_CHANNEL_ID secret. The rotation cadence lives on the Rotation Schedule block.