bug: SecretsManagerRotationEnabled is non compliant even if rotation is configured after cdk v2.116

[clueleaf]

What is the problem?

When using cdk v2.116.0 or later, even if Secrets Manager secret rotation is configured, SecretsManagerRotationEnabled rule results in non-compliant.

Reproduction Steps

1. Create a secret, configure the rotation.

    new secretsmanager.Secret(this, "Secret").addRotationSchedule("my-secret-rotation-schedule", {
      hostedRotation: secretsmanager.HostedRotation.mysqlSingleUser(),
      automaticallyAfter: Duration.days(30),
    });

2. Synth the stack using cdk v2.115.0. No cdk-nag error shows up. The cfn template contains the following:

  "MyConstructSecretmysecretrotationscheduleDDD9F0F6": {
   "Type": "AWS::SecretsManager::RotationSchedule",
   "Properties": {
    "HostedRotationLambda": {
     "ExcludeCharacters": " %+~`#$&*()|[]{}:;<>?!'/@\"\\",
     "RotationType": "MySQLSingleUser"
    },
    "RotationRules": {
     "AutomaticallyAfterDays": 30
    },
    "SecretId": {
     "Ref": "MyConstructSecretA546D653"
    }
   },
  },

3. Use cdk v2.116.0 and synth again. The following cdk-nag error shows up this time.

[Error at /MyStack/MyConstruct/Secret/Resource] AwsSolutions-SMG4: The secret does not have automatic rotation scheduled. AWS Secrets Manager can be configured to automatically rotate the secret for a secured service or database.

4. When I remove cdk-nag checks, the cfn template is like this. RotationRules.AutomaticallyAfterDays is replaced by RotationRules.ScheduleExpression due to fix(secretsmanager): cannot set hourly rotation aws/aws-cdk#28303

  "MyConstructSecretmysecretrotationscheduleDDD9F0F6": {
   "Type": "AWS::SecretsManager::RotationSchedule",
   "Properties": {
    "HostedRotationLambda": {
     "ExcludeCharacters": " %+~`#$&*()|[]{}:;<>?!'/@\"\\",
     "RotationType": "MySQLSingleUser"
    },
    "RotationRules": {
     "ScheduleExpression": "rate(30 days)"
    },
    "SecretId": {
     "Ref": "MyConstructSecretA546D653"
    }
   },
  },

What did you expect to happen?

SecretsManagerRotationEnabled rule results in compliant when using cdk v2.116.0 or later.

What actually happened?

SecretsManagerRotationEnabled is non compliant when using cdk v2.116.0 or later.

cdk-nag version

2.28.11

Language

Typescript

Other information

I will try to fix this later.