rotation.yml

---
AWSTemplateFormatVersion: 2010-09-09
Transform:
  - "AWS::Serverless-2016-10-31"

Parameters:
  App:
    Type: String
    Description: Your application's name.
  Env:
    Type: String
    Description: The environment name your service, job, or workflow is being deployed to.
  Name:
    Type: String
    Description: The name of the service, job, or workflow being deployed.

Resources:
  SecretRotationTemplate:
    Type: AWS::Serverless::Application
    Properties:
      Location:
        ApplicationId: arn:aws:serverlessrepo:us-east-1:297356227824:applications/SecretsManagerRDSPostgreSQLRotationSingleUser
        SemanticVersion: 1.1.60
      Parameters:
        endpoint: !Sub https://secretsmanager.${AWS::Region}.amazonaws.com
        functionName: !Sub ${AWS::StackName}-func
        vpcSecurityGroupIds: !Ref RotationSecurityGroup
        vpcSubnetIds:
          Fn::Join:
            - ","
            - - !Select [
                  0,
                  !Split [
                    ",",
                    { "Fn::ImportValue": !Sub "${App}-${Env}-PrivateSubnets" },
                  ],
                ]
              - !Select [
                  1,
                  !Split [
                    ",",
                    { "Fn::ImportValue": !Sub "${App}-${Env}-PrivateSubnets" },
                  ],
                ]

  SecretRotationSchedule:
    Type: AWS::SecretsManager::RotationSchedule
    Properties:
      SecretId: !Ref AuroraSecret
      RotationLambdaARN: !GetAtt SecretRotationTemplate.Outputs.RotationLambdaARN
      RotationRules:
        AutomaticallyAfterDays: 30