Stop Overpaying for Secrets You Never Rotate: Migrate to SSM Parameter Store with Terraform 🔐

# audit/secrets-audit.tf

resource "aws_lambda_function" "secrets_auditor" {
filename = data.archive_file.auditor.output_path
function_name = "secrets-migration-auditor"
role = aws_iam_role.auditor.arn
handler = "index.handler"
runtime = "python3.12"
timeout = 120
source_code_hash = data.archive_file.auditor.output_base64sha256

environment {
variables = {
SNS_TOPIC_ARN = aws_sns_topic.audit_results.arn
}
}
}

data "archive_file" "auditor" {
type = "zip"
output_path = "${path.module}/auditor.zip"

source {
content = <<-PYTHON
import boto3
import json
import os

sm = boto3.client('secretsmanager')
sns = boto3.client('sns')

def handler(event, context):
paginator = sm.get_paginator('list_secrets')

can_migrate = []
must_stay = []
total_cost = 0

for page in paginator.paginate():
for secret in page['SecretList']:
name = secret['Name']
total_cost += 0.40

has_rotation = secret.get('RotationEnabled', False)
has_replicas = len(secret.get('ReplicationStatus', [])) > 0

# Check secret size
try:
value = sm.get_secret_value(SecretId=name)
size = len(value.get('SecretString', '') or
value.get('SecretBinary', b''))
oversized = size > 8192 # 8KB SSM limit
except Exception:
oversized = False
size = 0

info = {
'name': name,
'rotation': has_rotation,
'replicas': has_replicas,
'size_bytes': size,
'oversized': oversized
}

if has_rotation or has_replicas or oversized:
info['reason'] = []
if has_rotation: info['reason'].append('rotation enabled')
if has_replicas: info['reason'].append('has replicas')
if oversized: info['reason'].append(f'oversized ({size} bytes)')
must_stay.append(info)
else:
can_migrate.append(info)

migrate_savings = len(can_migrate) * 0.40

report = (
f"Secrets Manager Migration Audit\n"
f"{'='*40}\n\n"
f"Total secrets: {len(can_migrate) + len(must_stay)}\n"
f"Current monthly cost: ${total_cost:.2f}\n\n"
f"CAN MIGRATE to SSM ({len(can_migrate)} secrets):\n"
)
for s in can_migrate:
report += f" ✅ {s['name']} ({s['size_bytes']} bytes)\n"

report += f"\nMUST STAY in Secrets Manager ({len(must_stay)} secrets):\n"
for s in must_stay:
reasons = ', '.join(s['reason'])
report += f" ❌ {s['name']} ({reasons})\n"

report += (
f"\nPotential monthly savings: ${migrate_savings:.2f}\n"
f"Potential annual savings: ${migrate_savings * 12:.2f}"
)

sns.publish(
TopicArn=os.environ['SNS_TOPIC_ARN'],
Subject=f'Secrets Audit: {len(can_migrate)} can migrate, save ${migrate_savings:.2f}/mo',
Message=report
)

return {
'can_migrate': len(can_migrate),
'must_stay': len(must_stay),
'monthly_savings': migrate_savings
}
PYTHON
filename = "index.py"
}
}

resource "aws_sns_topic" "audit_results" {
name = "secrets-migration-audit"
}

resource "aws_iam_role" "auditor" {
name = "secrets-auditor-role"

assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [{
Action = "sts:AssumeRole"
Effect = "Allow"
Principal = { Service = "lambda.amazonaws.com" }
}]
})
}

resource "aws_iam_role_policy" "auditor" {
name = "secrets-auditor-policy"
role = aws_iam_role.auditor.id

policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Effect = "Allow"
Action = ["secretsmanager:ListSecrets", "secretsmanager:GetSecretValue"]
Resource = "*"
},
{
Effect = "Allow"
Action = ["sns:Publish"]
Resource = aws_sns_topic.audit_results.arn
},
{
Effect = "Allow"
Action = ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"]
Resource = "arn:aws:logs:*:*:*"
}
]
})
}