fn::rotate

Some of a rotator’s inputs may only be evaluated when the environment containing the fn::rotate invocation is rotated. This can be combined with the environments built-in value to fetch managing credentials from other environments that may require additional permissions beyond those given to typical users of an environment. The exact inputs that are rotation-only are dependent on the rotator.

Declaration

fn::rotate:
  provider: name
  inputs: inputs
  state: state

Short form

In addition to the long form syntax, fn::rotate can be invoked using the short form fn::rotate::name:

fn::rotate::name:
  inputs: inputs
  state: state

Parameters

Property	Type	Description
`name`	string	The name of the rotator to use.
`inputs`	any	The inputs to the rotator. The exact type is rotator-dependent.
`state`	any	The persistent state for the rotator. This value is managed by the rotator and should not be modified.

Returns

The return value of fn::rotate is dependent on the rotator being invoked.

Example

Long form

values:
  aws:
    iam:
      fn::rotate:
        provider: aws-iam
        inputs:
          region: us-west-2
          login: ${environments.admin.production.aws.login}
          userArn: arn::aws:iam::012345678901:user/my-user
        state:
          current: ...
          previous: ...

Short form

values:
  aws:
    iam:
      fn::rotate::aws-iam:
        inputs:
          region: us-west-2
          login: ${environments.admin.production.aws.login}
          userArn: arn::aws:iam::012345678901:user/my-user
        state:
          current: ...
          previous: ...

Evaluated result

{
  "aws": {
    "iam": {
      "current": ...,
      "previous": ...
    }
  }
}

fn::rotate

On this page

On this page

Declaration

Short form

Parameters

Returns

Example

Long form

Short form

Evaluated result

On this page

On this page