RotationEventSource

Source: src/AWS/SecretsManager/RotationEventSource.ts

Event source connecting a Secrets Manager Secret’s rotation to the hosting Lambda function.

The contract is a Binding.Service; the Lambda implementation layer is Lambda.SecretRotationEventSource — at deploy time it grants Secrets Manager permission to invoke the function, attaches the rotation-protocol IAM actions for the secret, and provisions the RotationSchedule; at runtime it narrows incoming invocations to rotation events for the bound secret. Consume it through the onSecretRotation helper.

Rotating Secrets

export default RotationFunction.make(
  { main: import.meta.url },
  Effect.gen(function* () {
    const secret = yield* SecretsManager.Secret("DbPassword", {
      secretString: Redacted.make("initial"),
    });
    const getValue = yield* SecretsManager.GetSecretValue(secret);
    const putValue = yield* SecretsManager.PutSecretValue(secret);
    const updateStage = yield* SecretsManager.UpdateSecretVersionStage(secret);
    const describe = yield* SecretsManager.DescribeSecret(secret);
    const randomPassword = yield* SecretsManager.GetRandomPassword();

    yield* SecretsManager.onSecretRotation(
      secret,
      { rotationRules: { automaticallyAfter: "30 days" } },
      (event) => rotate(event).pipe(Effect.orDie),
    );
  }).pipe(Effect.provide(Lambda.SecretRotationEventSource)),
);