SECURITY · SCHEDULE

Expiry Sweep

Expired certificates are the most preventable outage in existence, and they still happen everywhere. This loop makes them structurally impossible: every credential with a clock on it is inventoried weekly, and anything inside 30 days gets a rotation PR with an owner attached.

TRIGGER

cron Mon 09:00 IST weekly

SWEEP

ACM, KMS, GCP SA keys, Vault leases, custom cert paths

GATE

expiry < 30 days AND no rotation PR already open

ACT

rotation PR from runbook template + owner ping in Slack

01 — INSTALL

brew install supraj/tap/expiry-sweep
expiry-sweep init --aws --gcp --vault https://vault.acme.dev

02 — CONFIGURE

Each credential type maps to a rotation runbook. Unknown types get an inventory alert, not a PR.

# sweep.yaml
schedule: '0 9 * * 1'   # Mon IST
sources: [acm, kms, gcp-sa, vault]
extra_paths:
  - k8s://cert-manager/certificates
threshold: 30d
rotate:
  acm: runbooks/rotate-acm.md
  gcp-sa: runbooks/rotate-sa.md
notify: owner_from_tags   # falls back to #platform

03 — HOW IT WORKS

Sweeps every credential source weekly and keeps a full inventory — the report shows what's healthy, not just what's dying.

Inside 30 days: it opens the rotation PR from your runbook template and assigns the owner from resource tags.

Zero-noise design: one PR per credential, deduplicated across weeks, escalating to a human ping only at 7 days.

04 — EXAMPLE OUTPUT

$ expiry-sweep report
swept 214 credentials across 4 sources
  ● 209 healthy (> 30d)
  ⚠ 4 rotation PRs open (oldest: 12d)
  🚨 1 at 6 days → escalated to @rahul
lapses in last 18 months: 0 ✓