Unused secrets can be misused by former users who no longer need access to these secrets. Additionally, as more users gain access to a secret, it becomes increasingly possible that someone has misused a secret or has granted access to an unauthorized entity. Deleting unused secrets helps revoke secret access from users who no longer need it, and can reduce your cost of using AWS Secrets Manager.
This recommendation identifies secrets that have not been accessed within a specified number of days.

1. Get relevant (unused) keys by the list_secrets call and retrieve the 'LastAccessedDate'.
2. Compare 'LastAccessedDate' to the preferences.
3. Validate that the service has been used for more than a trial period in this linked account.

1. Unused For Days: Number of days without operation, 60 days as a default.
2. Trial Period Days: AWS Trial period, 30 days as a default.
3. Include Planned Deletion: Include keys marked for deletion to ensure we show all the items, or exclude those already “pseudo handled”. Default = “false” (do not include).

Umbrella.

No.

Add the following permissions to the policy:

secretsmanager:DescribeSecret
secretsmanager:ListSecrets