SecretRotationEventSource

Source: src/AWS/Lambda/SecretRotationEventSource.ts

Lambda runtime implementation for AWS.SecretsManager.onSecretRotation(...).

This layer does three things at deploy time:

1. Grants secretsmanager.amazonaws.com permission to invoke the current function (scoped to this account via aws:SourceAccount).
2. Attaches the rotation-protocol IAM actions for the bound secret (DescribeSecret, GetSecretValue, PutSecretValue, UpdateSecretVersionStage on the secret + GetRandomPassword).
3. Provisions the RotationSchedule configuring the secret’s rotation to invoke this function — threaded through the Permission so Secrets Manager’s invoke-permission validation passes.

At runtime it narrows incoming invocations to rotation events for the bound secret and forwards them to the supplied handler.

Rotating Secrets

yield* SecretsManager.onSecretRotation(
  secret,
  { rotationRules: { automaticallyAfter: "30 days" } },
  (event) => rotate(event).pipe(Effect.orDie),
);