{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/aws-secrets-manager-rotation-window-utc-not-exact-time/", "item": { "id": "https://update.dsesecurity.com/updates/aws-secrets-manager-rotation-window-utc-not-exact-time/", "slug": "aws-secrets-manager-rotation-window-utc-not-exact-time", "url": "https://update.dsesecurity.com/updates/aws-secrets-manager-rotation-window-utc-not-exact-time/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/aws-secrets-manager-rotation-window-utc-not-exact-time.md", "json": "https://update.dsesecurity.com/api/v1/posts/aws-secrets-manager-rotation-window-utc-not-exact-time/" }, "title": "Translate Secrets Manager rotation windows into the operations team’s local time", "summary": "A rotation window permits execution within an interval and uses UTC rather than the operator’s local timezone.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:14:16+00:00", "modified_at": "2026-10-20T18:34:30+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 267, "potentially_affected": "This describes Secrets Manager scheduling. It does not identify an exact credential-change minute or prove an application is ready to handle a rotation during that interval.", "dse_recommendation": "DSE recommends recording both UTC and the relevant local maintenance interval in the credential change plan.", "primary_source": { "name": "AWS — Rotation schedules", "url": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_schedule.html", "published_on": null, "authority": "docs.aws.amazon.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

A rotation window permits execution within an interval and uses UTC rather than the operator’s local timezone.

\n

Source facts

\n

Secrets Manager rotation schedules use UTC. AWS states that rotation occurs at some time during the configured window, whose start is always on the hour. Cron expressions can set its start time. The configured window must not extend into the next rotation window. AWS documents hour-based and day-based schedules with different default window lengths.

\n

Source: AWS — Rotation schedules.

\n

Applicability

\n

This describes Secrets Manager scheduling. It does not identify an exact credential-change minute or prove an application is ready to handle a rotation during that interval.

\n

DSE recommendation

\n

DSE recommends recording both UTC and the relevant local maintenance interval in the credential change plan. Review seasonal clock changes with the application owner if local staffing or business hours are important. Check the entire possible execution interval against maintenance, release and support coverage. Assign an escalation owner for rotation failures and avoid scheduling downstream work around an assumed exact start minute. Put the complete possible window in the maintenance calendar rather than a single appointment time. Ask the on-call owner to confirm coverage across that interval and record how the team will interpret UTC event timestamps during a rotation investigation.

\n

Verification

\n

Proposed verification: inspect the saved expression, window duration and next expected interval. In an authorized test secret, compare observed rotation events with the approved window. Confirm monitoring and the operator runbook display time references clearly, and test the application’s credential refresh without treating one execution time as a future guarantee.

\n

Official reference

\n

AWS — Rotation schedules. Reviewed October 20, 2026.

", "content_text": "A rotation window permits execution within an interval and uses UTC rather than the operator’s local timezone.\nSource facts\nSecrets Manager rotation schedules use UTC. AWS states that rotation occurs at some time during the configured window, whose start is always on the hour. Cron expressions can set its start time. The configured window must not extend into the next rotation window. AWS documents hour-based and day-based schedules with different default window lengths.\nSource: AWS — Rotation schedules.\nApplicability\nThis describes Secrets Manager scheduling. It does not identify an exact credential-change minute or prove an application is ready to handle a rotation during that interval.\nDSE recommendation\nDSE recommends recording both UTC and the relevant local maintenance interval in the credential change plan. Review seasonal clock changes with the application owner if local staffing or business hours are important. Check the entire possible execution interval against maintenance, release and support coverage. Assign an escalation owner for rotation failures and avoid scheduling downstream work around an assumed exact start minute. Put the complete possible window in the maintenance calendar rather than a single appointment time. Ask the on-call owner to confirm coverage across that interval and record how the team will interpret UTC event timestamps during a rotation investigation.\nVerification\nProposed verification: inspect the saved expression, window duration and next expected interval. In an authorized test secret, compare observed rotation events with the approved window. Confirm monitoring and the operator runbook display time references clearly, and test the application’s credential refresh without treating one execution time as a future guarantee.\nOfficial reference\nAWS — Rotation schedules. Reviewed October 20, 2026.", "content_markdown": "A rotation window permits execution within an interval and uses UTC rather than the operator’s local timezone.\n\n## Source facts\n\nSecrets Manager rotation schedules use UTC. AWS states that rotation occurs at some time during the configured window, whose start is always on the hour. Cron expressions can set its start time. The configured window must not extend into the next rotation window. AWS documents hour-based and day-based schedules with different default window lengths.\n\nSource: [AWS — Rotation schedules](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_schedule.html).\n\n## Applicability\n\nThis describes Secrets Manager scheduling. It does not identify an exact credential-change minute or prove an application is ready to handle a rotation during that interval.\n\n## DSE recommendation\n\nDSE recommends recording both UTC and the relevant local maintenance interval in the credential change plan. Review seasonal clock changes with the application owner if local staffing or business hours are important. Check the entire possible execution interval against maintenance, release and support coverage. Assign an escalation owner for rotation failures and avoid scheduling downstream work around an assumed exact start minute. Put the complete possible window in the maintenance calendar rather than a single appointment time. Ask the on-call owner to confirm coverage across that interval and record how the team will interpret UTC event timestamps during a rotation investigation.\n\n## Verification\n\nProposed verification: inspect the saved expression, window duration and next expected interval. In an authorized test secret, compare observed rotation events with the approved window. Confirm monitoring and the operator runbook display time references clearly, and test the application’s credential refresh without treating one execution time as a future guarantee.\n\n## Official reference\n\n[AWS — Rotation schedules](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_schedule.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-rotation-window-utc-not-exact-time/", "url": "https://update.dsesecurity.com/updates/aws-secrets-manager-rotation-window-utc-not-exact-time/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-rotation-window-utc-not-exact-time/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Business Continuity", "item": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "ListItem", "position": 3, "name": "Translate Secrets Manager rotation windows into the operations team’s local time", "item": "https://update.dsesecurity.com/updates/aws-secrets-manager-rotation-window-utc-not-exact-time/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-rotation-window-utc-not-exact-time/#article", "identifier": "https://update.dsesecurity.com/updates/aws-secrets-manager-rotation-window-utc-not-exact-time/", "url": "https://update.dsesecurity.com/updates/aws-secrets-manager-rotation-window-utc-not-exact-time/", "headline": "Translate Secrets Manager rotation windows into the operations team’s local time", "description": "A rotation window permits execution within an interval and uses UTC rather than the operator’s local timezone.", "abstract": "A rotation window permits execution within an interval and uses UTC rather than the operator’s local timezone.", "articleBody": "A rotation window permits execution within an interval and uses UTC rather than the operator’s local timezone.\nSource facts\nSecrets Manager rotation schedules use UTC. AWS states that rotation occurs at some time during the configured window, whose start is always on the hour. Cron expressions can set its start time. The configured window must not extend into the next rotation window. AWS documents hour-based and day-based schedules with different default window lengths.\nSource: AWS — Rotation schedules.\nApplicability\nThis describes Secrets Manager scheduling. It does not identify an exact credential-change minute or prove an application is ready to handle a rotation during that interval.\nDSE recommendation\nDSE recommends recording both UTC and the relevant local maintenance interval in the credential change plan. Review seasonal clock changes with the application owner if local staffing or business hours are important. Check the entire possible execution interval against maintenance, release and support coverage. Assign an escalation owner for rotation failures and avoid scheduling downstream work around an assumed exact start minute. Put the complete possible window in the maintenance calendar rather than a single appointment time. Ask the on-call owner to confirm coverage across that interval and record how the team will interpret UTC event timestamps during a rotation investigation.\nVerification\nProposed verification: inspect the saved expression, window duration and next expected interval. In an authorized test secret, compare observed rotation events with the approved window. Confirm monitoring and the operator runbook display time references clearly, and test the application’s credential refresh without treating one execution time as a future guarantee.\nOfficial reference\nAWS — Rotation schedules. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:14:16+00:00", "dateModified": "2026-10-20T18:34:30+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-rotation-window-utc-not-exact-time/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-rotation-window-utc-not-exact-time/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Translate Secrets Manager rotation windows into the operations team’s local time" }, "articleSection": [ "Business Continuity", "Cybersecurity", "IT" ], "keywords": [ "Business Continuity", "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 267, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "AWS — Rotation schedules", "url": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_schedule.html" } } ] } }