Secrets Rotation Calculator
Work out rotation window risk as exposure days over rotation period, plus manual rotation effort, storage cost and a recommended period.
Inputs
AWS Secrets Manager charges $0.40 per secret per month
Rotation Risk Score
36.4/ 100
Rotation Window Risk Ratio
0.333×
Risk Level
Low
Rotations per Year
1,703rotations
Manual Rotation Effort
269.7hours/year
Annual Manual Rotation Cost
$22,924
Monthly Secret Storage Cost
$168.00
Recommended Rotation Period
15days
Verdict
Automate the remaining secrets — manual rotation is the reason periods get stretched
Step by step
Values used
Secrets under management = 420 secrets; Rotation period = 90 days; Days a leaked secret goes undetected = 30 days; Secrets on automatic rotation = 62 %; Engineer time per manual rotation = 25 minutes; Engineer hourly cost = 85 USD/hour; Secret storage price = 0.4000 USD/secret/month; Failed rotations per year = 18 failures
Secrets Rotation
Rotation window risk ratio = days a leaked secret goes undetected ÷ rotation period. A ratio of 1 or more means rotation, not detection, is what ends the exposure.
Risk scoring
Risk score = 30 × min(2, ratio) + 0.3 × (100 − automatic rotation coverage) + min(40, 0.5 × effective window days), where the effective window is min(exposure days, rotation period).
Rotation Risk Score
= 36.4 / 100
Rotation Window Risk Ratio
= 0.333 ×
Risk Level
= Low
Rotations per Year
= 1,703 rotations
Manual Rotation Effort
= 269.7 hours/year
Annual Manual Rotation Cost
= 22,924
How it works
Rotation caps the damage window at the rotation period, and detection caps it at the detection time, so the real exposure is whichever is shorter. The ratio between them tells you which control is doing the work: below 1 you find leaks before rotation would have helped, at or above 1 you are relying entirely on the calendar. A ninety-day rotation period sounds diligent until you notice that credentials leak to public repositories in minutes and are used within hours — the period only bounds the tail, and the recommended figure here is half the detection window so a leaked secret expires before it is worth selling.
Formulas
Secrets Rotation
Rotation window risk ratio = days a leaked secret goes undetected ÷ rotation period. A ratio of 1 or more means rotation, not detection, is what ends the exposure.
- exposureDays
- Mean time to detect that a secret has leaked
- rotationPeriodDays
- Days between scheduled rotations
- riskRatio
- Exposure days ÷ rotation period
Risk scoring
Risk score = 30 × min(2, ratio) + 0.3 × (100 − automatic rotation coverage) + min(40, 0.5 × effective window days), where the effective window is min(exposure days, rotation period).
- effectiveWindowDays
- The shorter of detection time and rotation period — how long a leaked secret actually works
- coveragePts
- Penalty for secrets still rotated by hand
Frequently Asked Questions
How is Secrets Rotation calculated?
Rotation window risk ratio = days a leaked secret goes undetected ÷ rotation period. A ratio of 1 or more means rotation, not detection, is what ends the exposure. Rotation caps the damage window at the rotation period, and detection caps it at the detection time, so the real exposure is whichever is shorter. The ratio between them tells you which control is doing the work: below 1 you find leaks before rotation would have helped, at or above 1 you are relying entirely on the calendar.
Why does Secrets Rotation matter?
A ninety-day rotation period sounds diligent until you notice that credentials leak to public repositories in minutes and are used within hours — the period only bounds the tail, and the recommended figure here is half the detection window so a leaked secret expires before it is worth selling.
What values do I need to enter?
This calculator takes 8 inputs: Secrets under management, Rotation period, Days a leaked secret goes undetected, Secrets on automatic rotation, Engineer time per manual rotation, Engineer hourly cost, Secret storage price, Failed rotations per year. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Is more frequent rotation always better?
No — it trades one risk for another. Every rotation is a chance of an outage, and a team that gets paged by rotation failures will quietly widen the period or disable it. Fix the failure rate first, automate second, then shorten. A reliable 30-day rotation beats an aspirational 7-day one that is switched off.
Should short-lived credentials replace rotation entirely?
Where you can, yes. An IAM role with 15-minute credentials or an OIDC-federated workload token has no rotation problem because there is nothing long-lived to rotate. Reserve stored secrets for the cases that genuinely cannot federate, such as third-party API keys and legacy database users.
You might also need
- Cloud IAM Risk CalculatorCommonly used together
- Secrets Exposure CalculatorCommonly used together
- Cloud Key Management CalculatorCommonly used together
- Cloud Security Health Score CalculatorAlso in Cloud Security
- Container Escape Risk CalculatorAlso in Cloud Security
- Container Image Vulnerability CalculatorAlso in Cloud Security