AWS just closed a gap that many platform teams struggled with: knowing, at the exact moment, that a secret’s value changed. Since July 22, 2026, AWS Secrets Manager automatically publishes events to Amazon EventBridge whenever it rotates or changes the active value of a secret. This is not just another line on the release notes: it changes how your applications react to credential rotation.

This note explains what AWS announced, what problem it solves and —most importantly for a technology leader— when it is worth wiring up the automatic reaction and when it is not.

What AWS announced, specifically

Secrets Manager now emits an event named Secret Label Updated to the default EventBridge event bus whenever a staging label moves to a new version of a secret. That includes custom labels; the only ones that do not trigger an event are AWSPENDING and AWSPREVIOUS.

Three details that matter:

  • Enabled by default for all secrets, with no configuration or opt-in.
  • No additional cost, in all Regions where Secrets Manager is available.
  • Value changes only, not metadata: no events are emitted for changes to tags, description, rotation configuration or resource policies.

To detect the case you almost always care about —that the secret’s active value changed— you filter by the AWSCURRENT label. When AWSCURRENT points to a new version, the credential your applications should use has just changed.

The problem it solves

Before this launch, there was no direct event. To find out about a rotation you had to rely on AWS CloudTrail, route those records into EventBridge and correlate several API calls —rotation success, PutSecretValue, UpdateSecretValue— to infer that the secret had changed. It worked, but it was fragile logic you had to write, test and maintain, and it broke with every nuance of the rotation flow.

The native event removes that correlation. Secrets Manager tells you directly “this secret changed value,” and you decide what to do with that signal.

What it means for your architecture

Here is the real value, beyond the headline. An EventBridge event can be routed to targets like AWS Lambda, Amazon SNS, Amazon SQS or AWS Step Functions. That opens three concrete patterns:

1. Refresh cached credentials without polling. Many applications keep database credentials in memory to avoid calling Secrets Manager on every request. The classic problem: when the secret rotates, the cached copy goes stale and authentication errors appear until the next restart. With the event, a Lambda function can notify your services —or restart dependent tasks— the instant AWSCURRENT changes, closing that stale-credential window.

2. Automatic compliance evidence. For banking, insurance and any regulated environment, proving that secrets rotate on policy is part of the audit. With this event you can record each rotation into an evidence system, update a compliance report or trigger a Step Functions workflow that documents the change, without depending on someone reviewing logs by hand.

3. Security alerts on unexpected changes. If a secret value changes outside the scheduled rotation window, that can be a signal worth investigating. An EventBridge rule routing to SNS lets you alert the security team on changes that do not match the expected calendar.

When to wire it up (and when not to)

Not every secret needs an event consumer. The decision is engineering, not fashion:

  • Wire it up when you have applications that cache credentials and suffer errors during rotation, when you operate in a regulated environment that requires rotation evidence, or when you want early detection of anomalous changes.
  • You probably do not need it if your applications already fetch the secret from Secrets Manager on each use through the AWS client with managed caching, or if the secret rarely rotates and the impact of a brief window is negligible.

The rule of thumb: the event is cheap to listen to, but every consumer you add is code you have to maintain. Start with the case that generates incidents today —usually cached credentials— and grow from there.

What the event pattern looks like

To react only when the active value changes, the EventBridge rule filters by AWSCURRENT:

{
  "source": ["aws.secretsmanager"],
  "detail-type": ["Secret Label Updated"],
  "detail": {
    "labelUpdated": ["AWSCURRENT"]
  }
}

And if you want to scope it to one environment, you combine it with a name prefix:

{
  "source": ["aws.secretsmanager"],
  "detail-type": ["Secret Label Updated"],
  "detail": {
    "name": [{"prefix": "prod/"}],
    "labelUpdated": ["AWSCURRENT"]
  }
}

The Caleidos approach

At Caleidos we treat AWS Secrets Manager as the single source of truth for credentials and secrets, with managed rotation and least-privilege, role-based access. This native event fits that practice naturally: it lets us connect rotation to automatic reactions —credential refresh, compliance evidence, alerts— within an event-driven architecture, with no fragile correlation logic. If your team manages secrets at scale and wants rotation to stop being a source of incidents, it is part of how we design cloud security and the governance of your AWS platform.