Secrets Manager Version Cleanup: Retire Old Secret Versions After Rotation

Secrets manager version cleanup starts when rotated credentials leave old versions, labels, replicas, and rollback notes behind indefinitely. Keeping previous versions can help recovery during a rotation, but permanent old credentials expand blast radius and confuse incident response.

The useful outcome is a rotation record that proves current consumers use the new version, old deployments are outside rollback windows, and retention matches policy.

Key takeaways

• Review secret labels, consumer deployments, rollback policy, audit rules, and replicas together.
• Confirm applications restarted or reloaded credentials after rotation.
• Remove old versions only after supported rollback paths no longer need them.
• Clean up copied values in CI variables, local docs, and emergency runbooks too.
• Prevent recurrence by giving every rotation a version retirement date.

Version Evidence

Check	What to inspect	Cleanup signal
Version labels	Current, previous, pending, custom aliases	Old label no longer needed for rollback
Consumers	Deployments, jobs, functions, workers, scripts	All supported consumers read current value
Rotation window	Release history, rollback policy, incident notes	Prior version is outside rollback need
Replication	Regions, environments, backup stores	Old value is not copied elsewhere

Do not assume rotation completed because a new value exists. Consumers may cache credentials until restart.

Rotation Record

secret_version_review:
  secret: payments/webhook-signing-key
  current_version: v5
  previous_version: v4
  consumers_reloaded: true
  rollback_window_closed: true
  next_action: retire previous label and archived copies

This keeps the cleanup tied to operational reality rather than calendar age alone.

Cleanup Path

First, verify current version usage through deploy records, application health, authentication logs, or failed-auth absence. Then remove previous labels or aliases, update runbooks, delete copied CI variables, and retire old versions according to secret policy. Confirm alerting covers authentication failures after the change.

Do not rush secrets used by payment processors, SSO, signing keys, encryption workflows, or third-party callbacks. Do not rush if consumers include long-running jobs or offline clients that cannot reload immediately.

Prevention

Every rotation should create two tasks: deploy the new value and retire the old version. Secret metadata should include owner, consumer list, rotation reason, rollback window, and retirement date. Cleanup becomes reliable when it is part of rotation, not a later audit project.

FAQ

Should previous versions always be deleted?

Follow your retention and recovery policy. The point is to avoid indefinite previous credentials without a reason.

What about secrets copied outside the manager?

They must be part of the review. A clean manager does not help if old values remain in CI variables or docs.