Translate Secrets Manager rotation windows into the operations team’s local time

A rotation window permits execution within an interval and uses UTC rather than the operator’s local timezone.

Source facts

Secrets Manager rotation schedules use UTC. AWS states that rotation occurs at some time during the configured window, whose start is always on the hour. Cron expressions can set its start time. The configured window must not extend into the next rotation window. AWS documents hour-based and day-based schedules with different default window lengths.

Source: AWS — Rotation schedules.

Applicability

This describes Secrets Manager scheduling. It does not identify an exact credential-change minute or prove an application is ready to handle a rotation during that interval.

DSE recommendation

DSE recommends recording both UTC and the relevant local maintenance interval in the credential change plan. Review seasonal clock changes with the application owner if local staffing or business hours are important. Check the entire possible execution interval against maintenance, release and support coverage. Assign an escalation owner for rotation failures and avoid scheduling downstream work around an assumed exact start minute. Put the complete possible window in the maintenance calendar rather than a single appointment time. Ask the on-call owner to confirm coverage across that interval and record how the team will interpret UTC event timestamps during a rotation investigation.

Verification

Proposed verification: inspect the saved expression, window duration and next expected interval. In an authorized test secret, compare observed rotation events with the approved window. Confirm monitoring and the operator runbook display time references clearly, and test the application’s credential refresh without treating one execution time as a future guarantee.

Official reference

AWS — Rotation schedules. Reviewed October 20, 2026.