<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Secrets Rotation Automation — API Reference

## Vault CLI

```bash
# List secrets
vault kv list secret/

# Read secret metadata
vault kv metadata get secret/db/production

# Write new version
vault kv put secret/db/production password="new_password_here"

# Enable database secrets engine
vault secrets enable database

# Configure database connection
vault write database/config/production \
  plugin_name=postgresql-database-plugin \
  connection_url="postgresql://{{username}}:{{password}}@db:5432/app" \
  allowed_roles="app-role"

# Read dynamic credential
vault read database/creds/app-role

# Rotate root credentials
vault write -f database/rotate-root/production
```

## AWS Secrets Manager CLI

```bash
# Create secret
aws secretsmanager create-secret --name db/production --secret-string '{"password":"..."}'

# Get secret value
aws secretsmanager get-secret-value --secret-id db/production

# Enable rotation
aws secretsmanager rotate-secret \
  --secret-id db/production \
  --rotation-lambda-arn arn:aws:lambda:us-east-1:123:function:rotate-db \
  --rotation-rules AutomaticallyAfterDays=30

# Trigger immediate rotation
aws secretsmanager rotate-secret --secret-id db/production

# List secrets
aws secretsmanager list-secrets --filters Key=name,Values=db/
```

## Rotation Policies

| Secret Type | Max Age | Dynamic | Recommended TTL |
|-------------|---------|---------|----------------|
| Database credentials | 30 days | Yes | 1 hour |
| API keys | 90 days | No | N/A |
| Service accounts | 90 days | No | N/A |
| TLS certificates | 365 days | No | N/A |
| SSH keys | 180 days | No | N/A |

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | Audit/rotation successful |
| 1 | Overdue secrets found |
| 2 | Rotation error |
