The design mistakes that quietly break vulnerability management programs — noise, ownership confusion, unrealistic SLAs, no shared accountability — and the shared-responsibility model that fixes them.
As of July 2026, AWS Secrets Manager automatically publishes events to Amazon EventBridge whenever a secret value changes. No opt-in, no configuration, no extra cost. This is a significant improvement for anyone monitoring credential rotation or building event-driven security workflows. Before this, detecting secret changes meant parsing CloudTrail logs and correlating multiple API calls (PutSecretValue, UpdateSecretValue, rotation success/failure) — doable but brittle. Now you get a single, clean event on the default EventBridge bus every time a secret changes. ...