feat(secretsmanager): validate maximum value of automaticallyAfter in RotationSchedule

packages/aws-cdk-lib/aws-secretsmanager/lib/rotation-schedule.ts

@@ -37,6 +37,8 @@ export interface RotationScheduleOptions {
    * Specifies the number of days after the previous rotation before
    * Secrets Manager triggers the next automatic rotation.
    *
+   * The maximum value is 1000 days.
+   *
    * A value of zero will disable automatic rotation - `Duration.days(0)`.
    *
    * @default Duration.days(30)
@@ -125,6 +127,9 @@ export class RotationSchedule extends Resource {
     }
 
     let automaticallyAfterDays: number | undefined = undefined;
+    if (props.automaticallyAfter && props.automaticallyAfter.toDays() > 1000) {
+      throw new Error(`automaticallyAfter must not be greater than 1000 days, got ${props.automaticallyAfter.toDays()} days`);
+    }
     if (props.automaticallyAfter?.toMilliseconds() !== 0) {
       automaticallyAfterDays = props.automaticallyAfter?.toDays() || 30;
     }

packages/aws-cdk-lib/aws-secretsmanager/test/rotation-schedule.test.ts

@@ -651,3 +651,21 @@ test('rotation schedule should have a dependency on lambda permissions', () => {
     ],
   });
 });
+
+test('automaticallyAfter must not be greater than 1000 days', () => {
+  // GIVEN
+  const secret = new secretsmanager.Secret(stack, 'Secret');
+  const rotationLambda = new lambda.Function(stack, 'Lambda', {
+    runtime: lambda.Runtime.NODEJS_LATEST,
+    code: lambda.Code.fromInline('export.handler = event => event;'),
+    handler: 'index.handler',
+  });
+
+  // WHEN
+  // THEN
+  expect(() => new secretsmanager.RotationSchedule(stack, 'RotationSchedule', {
+    secret,
+    rotationLambda,
+    automaticallyAfter: Duration.days(1001),
+  })).toThrow(/automaticallyAfter must not be greater than 1000 days, got 1001 days/);
+});