Reference · built on requestOperator by FibricIT & reliability

Secret Rotation

Reads access-key ages, Vault rotation state, and leaked-secret alerts, and proposes each rotation with the services that depend on it.

Request accessPricing ↗

About

A secret is safe to rotate only when you know what uses it. Secret Rotation reads the age of each AWS access key from the credential report and the service that last used it, the static roles and rotation schedules in HashiCorp Vault, secret scanning alerts in GitHub with their validity, and item usage events from 1Password that show which people and machines fetch a shared credential.

For a key past your age limit, or an alert marked active, it proposes a rotation with the dependents listed and the order to update them. A person approves. The old key is set Inactive, not deleted, until the dependents have moved. The receipt records each key id, the services that used it, and the step where it stopped.

This is a reference listing. It documents what Fibric would read from Secret Rotation and what it could propose, based on the vendor's published interfaces. Fibric builds it under a managed deployment when you request it; selecting it here installs nothing.

Inputs

  • access_key_1_last_rotated, access_key_1_last_used_date, and access_key_1_last_used_service per user in the AWS IAM credential report, and the same for a second key
  • Static roles in the Vault database secrets engine with their rotation_period or rotation_schedule and rotation_window
  • Secret scanning alerts through GET /orgs/{org}/secret-scanning/alerts, with secret_type, validity active, inactive, or unknown, is_publicly_leaked, and locations
  • Item usage events from 1Password through POST /api/v2/itemusages: fill, reveal, secure-copy, export, and server-fetch, with the user and device
  • Open incidents in PagerDuty and issues in Jira that already name the credential

Proposed actions

  • Target capability: propose a rotation plan for an access key past its age limit: CreateAccessKey, dependents updated in order, UpdateAccessKey to Inactive, DeleteAccessKey later
  • Target capability: propose an immediate static role rotation in Vault through its rotate-role endpoint when a leak names that role's credential
  • Target capability: propose a PagerDuty trigger event, with a dedup_key per secret, for a secret scanning alert whose validity is active
  • Target capability: propose resolving a GitHub secret scanning alert as revoked, with a resolution_comment naming the rotation receipt, once the new secret is in place
  • Target capability: propose a Jira issue per rotation, listing each dependent service and the person who owns it

Proposed actions are target capabilities. Every action runs propose-first and needs a validated deployment and the appropriate permissions.

What you can build

  • Rotate the keys older than your policy allows

    Users whose access_key_1_last_rotated is past the limit get a proposed plan naming the last-used service and the systems holding the key in 1Password. Approval creates the new key; the old one goes Inactive after the dependents move.

    With 1Password, Jira

  • Act on a leaked token the day it is found

    A secret scanning alert with validity active opens a proposed PagerDuty incident and a rotation plan for the token's owner. Once rotated, the operator proposes resolving the alert as revoked with the receipt id.

    With GitHub, PagerDuty

  • Keep Vault rotations inside their window

    Static roles whose rotation_window passed without a rotation get a proposed rotate-role call, with the services that hold the current password, from 1Password events, listed for the approver.

    With 1Password, Slack

Requirements

  • AWS permissions iam:GenerateCredentialReport, iam:GetCredentialReport, and iam:GetAccessKeyLastUsed, plus iam:CreateAccessKey and iam:UpdateAccessKey where rotations are carried out
  • A GitHub token held by a repository or organization administrator, which the secret scanning endpoints require
  • A 1Password Business account with an Events Reporting integration token that includes itemusages
  • A Vault token allowed to read static role configuration and, if wanted, to call rotate-role on the mounts you name
  • A dependency map from service to secret, or the usage events and last-used services to build one from
Authentication
Reads key metadata, alerts, and usage events with the grants you attach. It never reads a secret value, and rotation calls run only after approval with the connector's own credentials.

Limits

  • The credential report covers two access keys per user and refreshes at most every four hours. Key use is recorded once per fifteen minutes.
  • 1Password returns events from the last 120 days, and item usage arrives when a client syncs, so a dependent found this way can appear late.
  • GitHub secret scanning reports what its patterns match. A custom credential with no pattern, and a secret outside a repository, do not raise an alert.
  • It never deletes a key while rotating it. Deletion is a separate proposal after the Inactive period you set, never for a recently used key.

Access and pricing

Reference listing. Fibric builds the operator under a managed deployment when you request it. Your quote covers the build, capabilities, usage, and support.

Request Secret Rotation ↗

Questions and answers

What does a person approve?
One rotation at a time: the key or role, its age or the alert that triggered it, the dependents in update order, and each step. Creating the new key, moving dependents, setting the old key Inactive, and deleting it are approved as separate steps.
What record is left?
A receipt per rotation: the key id or role, the last-used service and date, the dependents named, each step with who approved and when, the alert resolved in GitHub with its comment, and the Jira issue. Secret values never appear in it.
Does it ever see the secret?
No. It reads metadata: ages, last-used dates, validity, usage events, rotation schedules. A new AWS secret access key can be retrieved only when it is created, and the operator does not store it. Vault rotations happen inside Vault.
Ask about Secret Rotation

Ask about the capabilities and requirements in this listing.

For project-specific requirements, contact Fibric.

This operator is developed, published, and supported by Fibric. Third-party names and logos identify the systems an integration connects to; they are the property of their respective owners, who are not affiliated with Fibric and do not sponsor or endorse this listing. Trademark policy