fn::rotate

The fn::rotate built-in function invokes a rotator to rotate secrets.

Some of a rotator’s inputs may only be evaluated when the environment containing the fn::rotate invocation is rotated. This can be combined with the environments built-in value to fetch managing credentials from other environments that may require additional permissions beyond those given to typical users of an environment. The exact inputs that are rotation-only are dependent on the rotator.

Declaration

fn::rotate:  provider: name  inputs: inputs  state: state 

Short form

In addition to the long form syntax, fn::rotate can be invoked using the short form fn::rotate::name:

fn::rotate::name:  inputs: inputs  state: state 

Parameters

Returns

The return value of fn::rotate is dependent on the rotator being invoked.

Example

Long form

values:  aws:  iam:  fn::rotate:  provider: aws-iam  inputs:  region: us-west-2  login: ${environments.admin.production.aws.login}  userArn: arn::aws:iam::012345678901:user/my-user  state:  current: ...  previous: ... 

Short form

values:  aws:  iam:  fn::rotate::aws-iam:  inputs:  region: us-west-2  login: ${environments.admin.production.aws.login}  userArn: arn::aws:iam::012345678901:user/my-user  state:  current: ...  previous: ... 

Evaluated result

{  "aws": {  "iam": {  "current": ...,  "previous": ...  }  } }