aws-secretsmanager-audit — find the secrets that stopped rotating and nobody noticed

Secrets Manager is where a credential goes to be forgotten: rotation never enabled, rotation enabled but failing silently, secrets nothing has read in a year, managed-key encryption and wildcard resource policies. Nine rules, one pass over the account, an exit code you can gate CI on.