Repository: localstack/localstack

Issue:
bug: SecretsManager removes the AWSPREVIOUS stage label and its version when removing a different stage label
### Is there an existing issue for this?

- [X] I have searched the existing issues

### Current Behavior

**Given** two versions A and B, and version B has an `AWSPREVIOUS` stage label, **when** a stage label is removed from version A with the `update-secret-version-stage` command, **then** the stage label is removed from version A (as expected) AND version B is removed (unexpectedly). 

### Expected Behavior

The `update-secret-version-stage` command should only affect stage labels specified by the input parameters, and other stage labels, including `AWSPREVIOUS`, should not be affected. 


### How are you starting LocalStack?

With a docker-compose file

### Steps To Reproduce

#### How are you starting localstack (e.g., `bin/localstack` command, arguments, or `docker-compose.yml`)

docker-compose.yml

```
version: '3.4'
services:
  localstack:
    container_name: localstack
    image: localstack/localstack:latest
    ports:
      - 5670:4566
    environment:
      - DEBUG=1
```


#### Client commands (e.g., AWS SDK code snippet, or sequence of "awslocal" commands)

```
aws --endpoint-url=http://127.0.0.1:5670 secretsmanager create-secret \
--name=test \
--secret-string=test \
--region=ap-northeast-1
```

```
aws --endpoint-url=http://127.0.0.1:5670 secretsmanager put-secret-value \
--secret-id=test \
--secret-string=test2 \
--region=ap-northeast-1 \
--version-stages=PENDING
```

```
aws --endpoint-url=http://127.0.0.1:5670 secretsmanager list-secret-version-ids \
--secret-id=test \
--region=ap-northeast-1
```

```
{
    "Versions": [
        {
            "VersionId": "cc279696-7f93-4dc4-99dd-8f8e7112fb37",
            "VersionStages": [
                "PENDING"
            ],
            "CreatedDate": "2024-01-17T17:33:33.601708+09:00"
        },
        {
            "VersionId": "d9b7e6e4-5512-43f8-907f-6ba6623d1094",
            "VersionStages": [
                "AWSCURRENT"
            ],
            "CreatedDate": "2024-01-17T17:33:06.863652+09:00"
        }
    ],
    "ARN": "arn:aws:secretsmanager:ap-northeast-1:000000000000:secret:test-soExxm",
    "Name": "test"
}
```

```
aws --endpoint-url=http://127.0.0.1:5670 secretsmanager update-secret-version-stage \
--secret-id=test \
--region=ap-northeast-1 \
--version-stage=AWSCURRENT \
--remove-from-version-id=d9b7e6e4-5512-43f8-907f-6ba6623d1094 \
--move-to-version-id=cc279696-7f93-4dc4-99dd-8f8e7112fb37
```

```
{
    "Versions": [
        {
            "VersionId": "cc279696-7f93-4dc4-99dd-8f8e7112fb37",
            "VersionStages": [
                "PENDING",
                "AWSCURRENT"
            ],
            "CreatedDate": "2024-01-17T17:33:33.601708+09:00"
        },
        {
            "VersionId": "d9b7e6e4-5512-43f8-907f-6ba6623d1094",
            "VersionStages": [
                "AWSPREVIOUS"
            ],
            "CreatedDate": "2024-01-17T17:33:06.863652+09:00"
        }
    ],
    "ARN": "arn:aws:secretsmanager:ap-northeast-1:000000000000:secret:test-soExxm",
    "Name": "test"
}
```

```
aws --endpoint-url=http://127.0.0.1:5670 secretsmanager update-secret-version-stage \
--secret-id=test \
--region=ap-northeast-1 \
--version-stage=PENDING \
--remove-from-version-id=cc279696-7f93-4dc4-99dd-8f8e7112fb37
```

```
aws --endpoint-url=http://127.0.0.1:5670 secretsmanager list-secret-version-ids \
--secret-id=test \
--region=ap-northeast-1
```

```
{
    "Versions": [
        {
            "VersionId": "cc279696-7f93-4dc4-99dd-8f8e7112fb37",
            "VersionStages": [
                "AWSCURRENT"
            ],
            "CreatedDate": "2024-01-17T17:33:33.601708+09:00"
        }
    ],
    "ARN": "arn:aws:secretsmanager:ap-northeast-1:000000000000:secret:test-soExxm",
    "Name": "test"
}
```

### Environment

```markdown
- OS: MacOS Sonoma 14.2.1
- LocalStack: latest
```


### Anything else?

_No response_


Discussion:
Welcome to LocalStack! Thanks for reporting your first issue and our team will be working towards fixing the issue for you or reach out for more background information. We recommend joining our [Slack Community](https://localstack.cloud/contact/) for real-time help and drop a message to LocalStack Pro Support if you are a Pro user! If you are willing to contribute towards fixing this issue, please have a look at our [contributing guidelines](https://github.com/localstack/.github/blob/main/CONTRIBUTING.md) and our [contributing guide](https://docs.localstack.cloud/contributing/).

Resolving patch:
diff --git a/localstack/services/secretsmanager/provider.py b/localstack/services/secretsmanager/provider.py
--- a/localstack/services/secretsmanager/provider.py
+++ b/localstack/services/secretsmanager/provider.py
@@ -474,15 +474,21 @@ def backend_update_secret_version_stage(
         secret.default_version_id = move_to_version_id
 
     versions_no_stages = []
-    update_vid_set = {remove_from_version_id, move_to_version_id}
     for version_id, version in secret.versions.items():
         version_stages = version["version_stages"]
 
+        # moto appends a new AWSPREVIOUS label to the version AWSCURRENT was removed from,
+        # but it does not remove the old AWSPREVIOUS label.
         # Patch: ensure only one AWSPREVIOUS tagged version is in the pool.
-        if version_id not in update_vid_set and AWSPREVIOUS in version_stages:
+        if (
+            version_stage == AWSCURRENT
+            and version_id != remove_from_version_id
+            and AWSPREVIOUS in version_stages
+        ):
             version_stages.remove(AWSPREVIOUS)
-            if not version_stages:
-                versions_no_stages.append(version_id)
+
+        if not version_stages:
+            versions_no_stages.append(version_id)
 
     # Patch: remove secret versions with no version stages.
     for version_no_stages in versions_no_stages:


Test patch:
diff --git a/tests/aws/services/secretsmanager/test_secretsmanager.py b/tests/aws/services/secretsmanager/test_secretsmanager.py
--- a/tests/aws/services/secretsmanager/test_secretsmanager.py
+++ b/tests/aws/services/secretsmanager/test_secretsmanager.py
@@ -19,7 +19,7 @@
     DeleteSecretResponse,
     ListSecretsResponse,
 )
-from localstack.constants import TEST_AWS_ACCESS_KEY_ID, TEST_AWS_ACCOUNT_ID, TEST_AWS_REGION_NAME
+from localstack.constants import TEST_AWS_ACCESS_KEY_ID, TEST_AWS_REGION_NAME
 from localstack.testing.pytest import markers
 from localstack.utils.aws import aws_stack
 from localstack.utils.aws.request_context import mock_aws_request_headers
@@ -36,7 +36,7 @@
     "Statement": [
         {
             "Effect": "Allow",
-            "Principal": {"AWS": f"arn:aws:iam::{TEST_AWS_ACCOUNT_ID}:root"},
+            "Principal": "*",
             "Action": "secretsmanager:GetSecretValue",
             "Resource": "*",
         }
@@ -70,13 +70,15 @@ def sm_snapshot(self, snapshot):
     @staticmethod
     def _wait_created_is_listed(client, secret_id: str):
         def _is_secret_in_list():
-            lst: ListSecretsResponse = client.list_secrets()
+            lst: ListSecretsResponse = (
+                client.get_paginator("list_secrets").paginate().build_full_result()
+            )
             secret_ids: set[str] = {secret["Name"] for secret in lst.get("SecretList", [])}
             return secret_id in secret_ids
 
-        success = poll_condition(condition=_is_secret_in_list, timeout=20, interval=2)
-        if not success:
-            LOG.warning(f"Timed out whilst awaiting for secret '{secret_id}' to become listable.")
+        assert poll_condition(
+            condition=_is_secret_in_list, timeout=60, interval=2
+        ), f"Retried check for listing of {secret_id=} timed out"
 
     @staticmethod
     def _wait_force_deletion_completed(client, secret_id: str):
@@ -123,7 +125,7 @@ def _is_secret_rotated():
             "Valid/_+=.@-Name-a1b2c3-",
         ],
     )
-    @markers.aws.unknown
+    @markers.aws.validated
     def test_create_and_update_secret(self, secret_name: str, sm_snapshot, cleanups, aws_client):
         cleanups.append(
             lambda: aws_client.secretsmanager.delete_secret(
@@ -177,7 +179,7 @@ def test_create_and_update_secret(self, secret_name: str, sm_snapshot, cleanups,
         )
         sm_snapshot.match("delete_secret_res_1", delete_secret_res_1)
 
-    @markers.aws.unknown
+    @markers.aws.validated
     def test_secret_not_found(self, sm_snapshot, aws_client):
         with pytest.raises(Exception) as not_found:
             aws_client.secretsmanager.get_secret_value(SecretId=f"s-{short_uid()}")
@@ -187,8 +189,8 @@ def test_secret_not_found(self, sm_snapshot, aws_client):
             aws_client.secretsmanager.list_secret_version_ids(SecretId=f"s-{short_uid()}")
         sm_snapshot.match("list_secret_version_ids_not_found_ex", not_found.value.response)
 
-    @markers.aws.unknown
-    def test_call_lists_secrets_multiple_times(self, secret_name, aws_client):
+    @markers.aws.validated
+    def test_call_lists_secrets_multiple_times(self, secret_name, aws_client, cleanups):
         aws_client.secretsmanager.create_secret(
             Name=secret_name,
             SecretString="my_secret",
@@ -198,17 +200,16 @@ def test_call_lists_secrets_multiple_times(self, secret_name, aws_client):
 
         # call list_secrets multiple times
         for i in range(3):
-            rs = aws_client.secretsmanager.list_secrets()
+            rs = (
+                aws_client.secretsmanager.get_paginator("list_secrets")
+                .paginate()
+                .build_full_result()
+            )
             secrets = [secret for secret in rs["SecretList"] if secret["Name"] == secret_name]
             assert len(secrets) == 1
 
-        # clean up
-        aws_client.secretsmanager.delete_secret(
-            SecretId=secret_name, ForceDeleteWithoutRecovery=True
-        )
-
-    @pytest.mark.skip("In CI transformers are not applied for this test.")
-    @markers.aws.unknown
+    @pytest.mark.skip("needs to be reworked")
+    @markers.aws.needs_fixing  # remove comparison with full list of secrets in account
     def test_call_lists_secrets_multiple_times_snapshots(
         self, sm_snapshot, secret_name, aws_client
     ):
@@ -226,7 +227,11 @@ def test_call_lists_secrets_multiple_times_snapshots(
 
         # call list_secrets multiple times
         for i in range(3):
-            list_secrets_res = aws_client.secretsmanager.list_secrets()
+            list_secrets_res = (
+                aws_client.secretsmanager.get_paginator("list_secrets")
+                .paginate()
+                .build_full_result()
+            )
             sm_snapshot.match(f"list_secrets_res_{i}", list_secrets_res)
 
         # clean up
@@ -235,7 +240,7 @@ def test_call_lists_secrets_multiple_times_snapshots(
         )
         sm_snapshot.match("delete_secret_res_1", delete_secret_res_1)
 
-    @markers.aws.unknown
+    @markers.aws.validated
     def test_create_multi_secrets(self, cleanups, aws_client):
         secret_names = [short_uid(), short_uid(), short_uid()]
         arns = []
@@ -253,7 +258,7 @@ def test_create_multi_secrets(self, cleanups, aws_client):
             arns.append(rs["ARN"])
             self._wait_created_is_listed(aws_client.secretsmanager, secret_id=secret_name)
 
-        rs = aws_client.secretsmanager.list_secrets()
+        rs = aws_client.secretsmanager.get_paginator("list_secrets").paginate().build_full_result()
         secrets = {
             secret["Name"]: secret["ARN"]
             for secret in rs["SecretList"]
@@ -270,8 +275,8 @@ def test_create_multi_secrets(self, cleanups, aws_client):
                 SecretId=secret_name, ForceDeleteWithoutRecovery=True
             )
 
-    @pytest.mark.skip("In CI transformers are not applied for this test.")
-    @markers.aws.unknown
+    @pytest.mark.skip("needs to be reworked")
+    @markers.aws.needs_fixing  # FIXME: leaks, snapshot mismatches since it tests the complete list of secrets in the account
     def test_create_multi_secrets_snapshot(self, sm_snapshot, cleanups, aws_client):
         secret_names = [short_uid() for _ in range(3)]
         for i, secret_name in enumerate(secret_names):
@@ -291,7 +296,9 @@ def test_create_multi_secrets_snapshot(self, sm_snapshot, cleanups, aws_client):
 
             self._wait_created_is_listed(aws_client.secretsmanager, secret_name)
 
-        list_secrets_res = aws_client.secretsmanager.list_secrets()
+        list_secrets_res = (
+            aws_client.secretsmanager.get_paginator("list_secrets").paginate().build_full_result()
+        )
         sm_snapshot.match("list_secrets_res", list_secrets_res)
 
         # clean up
@@ -301,7 +308,7 @@ def test_create_multi_secrets_snapshot(self, sm_snapshot, cleanups, aws_client):
             )
             sm_snapshot.match(f"delete_secret_res{i}", delete_secret_res)
 
-    @markers.aws.unknown
+    @markers.aws.validated
     def test_get_random_exclude_characters_and_symbols(self, aws_client):
         random_password = aws_client.secretsmanager.get_random_password(
             PasswordLength=120, ExcludeCharacters="xyzDje@?!."
@@ -310,8 +317,8 @@ def test_get_random_exclude_characters_and_symbols(self, aws_client):
         assert len(random_password["RandomPassword"]) == 120
         assert all(c not in "xyzDje@?!." for c in random_password["RandomPassword"])
 
-    @markers.aws.unknown
-    def test_resource_policy(self, secret_name, aws_client):
+    @markers.aws.validated
+    def test_resource_policy(self, secret_name, aws_client, cleanups):
         aws_client.secretsmanager.create_secret(
             Name=secret_name,
             SecretString="my_secret",
@@ -332,11 +339,6 @@ def test_resource_policy(self, secret_name, aws_client):
         rs = aws_client.secretsmanager.delete_resource_policy(SecretId=secret_name)
         assert rs["ResponseMetadata"]["HTTPStatusCode"] == 200
 
-        # clean up
-        aws_client.secretsmanager.delete_secret(
-            SecretId=secret_name, ForceDeleteWithoutRecovery=True
-        )
-
     @pytest.mark.parametrize("rotate_immediately", [True, None])
     @markers.snapshot.skip_snapshot_verify(paths=["$..Versions..KmsKeyIds"])
     @markers.aws.validated
@@ -400,13 +402,24 @@ def test_rotate_secret_with_lambda_success(
 
         sm_snapshot.match("list_secret_versions_rotated_1", list_secret_versions_1)
 
-    @markers.aws.unknown
-    def test_rotate_secret_invalid_lambda_arn(self, secret_name, aws_client):
-        aws_client.secretsmanager.create_secret(Name=secret_name, SecretString="init")
+    @markers.snapshot.skip_snapshot_verify(paths=["$..Error", "$..Message"])
+    @markers.aws.validated
+    def test_rotate_secret_invalid_lambda_arn(
+        self, secret_name, aws_client, account_id, sm_snapshot
+    ):
+        create_secret = aws_client.secretsmanager.create_secret(
+            Name=secret_name, SecretString="init"
+        )
+        sm_snapshot.add_transformer(
+            sm_snapshot.transform.secretsmanager_secret_id_arn(create_secret, 0)
+        )
+        sm_snapshot.match("create_secret", create_secret)
+
+        region_name = aws_client.secretsmanager.meta.region_name
         invalid_arn = (
-            "arn:aws:lambda:sa-east-1:000000000000:function:rotate_secret_invalid_lambda_arn"
+            f"arn:aws:lambda:{region_name}:{account_id}:function:rotate_secret_invalid_lambda_arn"
         )
-        with pytest.raises(Exception) as res_not_found_ex:
+        with pytest.raises(Exception) as e:
             aws_client.secretsmanager.rotate_secret(
                 SecretId=secret_name,
                 RotationLambdaARN=invalid_arn,
@@ -414,18 +427,15 @@ def test_rotate_secret_invalid_lambda_arn(self, secret_name, aws_client):
                     "AutomaticallyAfterDays": 1,
                 },
             )
-        assert res_not_found_ex.typename == "ResourceNotFoundException"
-        assert (
-            res_not_found_ex.value.response["Error"]["Message"]
-            == "Lambda does not exist or could not be accessed"
-        )
+        sm_snapshot.match("rotate_secret_invalid_arn_exc", e.value.response)
 
-        des = aws_client.secretsmanager.describe_secret(SecretId=secret_name)
-        assert "RotationEnabled" not in des
-        assert "RotationRules" not in des
-        assert "RotationLambdaARN" not in des
+        describe_secret = aws_client.secretsmanager.describe_secret(SecretId=secret_name)
+        sm_snapshot.match("describe_secret", describe_secret)
+        assert "RotationEnabled" not in describe_secret
+        assert "RotationRules" not in describe_secret
+        assert "RotationLambdaARN" not in describe_secret
 
-    @markers.aws.unknown
+    @markers.aws.validated
     def test_put_secret_value_with_version_stages(self, sm_snapshot, secret_name, aws_client):
         secret_string_v0: str = "secret_string_v0"
 
@@ -565,7 +575,7 @@ def test_invalid_secret_name(self, sm_snapshot, cleanups, secret_name: str, aws_
             )
         sm_snapshot.match("ex_log_10", validation_exception.value.response)
 
-    @markers.aws.unknown
+    @markers.aws.validated
     def test_last_accessed_date(self, cleanups, aws_client):
         def last_accessed_scenario_1(fail_if_days_overlap: bool) -> bool:
             secret_name = f"s-{short_uid()}"
@@ -607,7 +617,7 @@ def last_accessed_scenario_1(fail_if_days_overlap: bool) -> bool:
                 True
             )  # Replay today or allow failure (this should never take longer than a day).
 
-    @markers.aws.unknown
+    @markers.aws.validated
     def test_last_updated_date(self, secret_name, aws_client):
         # TODO: moto is rounding time.time() but `secretsmanager`return a timestamp with 3 fraction digits
         # adapt the tests for around equality
@@ -651,7 +661,7 @@ def test_last_updated_date(self, secret_name, aws_client):
         assert "LastChangedDate" in res
         assert create_date < res["LastChangedDate"]
 
-    @markers.aws.unknown
+    @markers.aws.validated
     def test_update_secret_description(self, sm_snapshot, secret_name, aws_client):
         secret_string_v0 = "MySecretString"
         create_secret_rs_0 = aws_client.secretsmanager.create_secret(
@@ -705,7 +715,7 @@ def test_update_secret_description(self, sm_snapshot, secret_name, aws_client):
         )
         sm_snapshot.match("delete_secret_res_0", delete_secret_res_0)
 
-    @markers.aws.unknown
+    @markers.aws.validated
     def test_update_secret_version_stages_return_type(self, sm_snapshot, secret_name, aws_client):
         create_secret_rs_0 = aws_client.secretsmanager.create_secret(
             Name=secret_name, SecretString="Something1"
@@ -739,7 +749,7 @@ def test_update_secret_version_stages_return_type(self, sm_snapshot, secret_name
         sm_snapshot.match("delete_secret_res_0", delete_secret_res_0)
 
     @markers.snapshot.skip_snapshot_verify(paths=["$..KmsKeyId", "$..KmsKeyIds"])
-    @markers.aws.unknown
+    @markers.aws.validated
     def test_update_secret_version_stages_current_previous(
         self, sm_snapshot, secret_name, aws_client
     ):
@@ -777,7 +787,7 @@ def test_update_secret_version_stages_current_previous(
         sm_snapshot.match("delete_secret_res_0", delete_secret_res_0)
 
     @markers.snapshot.skip_snapshot_verify(paths=["$..KmsKeyId", "$..KmsKeyIds"])
-    @markers.aws.unknown
+    @markers.aws.validated
     def test_update_secret_version_stages_current_pending(
         self, sm_snapshot, secret_name, aws_client
     ):
@@ -832,7 +842,7 @@ def test_update_secret_version_stages_current_pending(
         sm_snapshot.match("delete_secret_res_0", delete_secret_res_0)
 
     @markers.snapshot.skip_snapshot_verify(paths=["$..KmsKeyId", "$..KmsKeyIds"])
-    @markers.aws.unknown
+    @markers.aws.validated
     def test_update_secret_version_stages_current_pending_cycle(
         self, sm_snapshot, secret_name, aws_client
     ):
@@ -914,7 +924,7 @@ def test_update_secret_version_stages_current_pending_cycle(
         sm_snapshot.match("delete_secret_res_0", delete_secret_res_0)
 
     @markers.snapshot.skip_snapshot_verify(paths=["$..KmsKeyId", "$..KmsKeyIds"])
-    @markers.aws.unknown
+    @markers.aws.validated
     def test_update_secret_version_stages_current_pending_cycle_custom_stages_1(
         self, sm_snapshot, secret_name, aws_client
     ):
@@ -995,7 +1005,7 @@ def test_update_secret_version_stages_current_pending_cycle_custom_stages_1(
         sm_snapshot.match("delete_secret_res_0", delete_secret_res_0)
 
     @markers.snapshot.skip_snapshot_verify(paths=["$..KmsKeyId", "$..KmsKeyIds"])
-    @markers.aws.unknown
+    @markers.aws.validated
     def test_update_secret_version_stages_current_pending_cycle_custom_stages_2(
         self, sm_snapshot, secret_name, aws_client
     ):
@@ -1087,7 +1097,100 @@ def test_update_secret_version_stages_current_pending_cycle_custom_stages_2(
         sm_snapshot.match("delete_secret_res_0", delete_secret_res_0)
 
     @markers.snapshot.skip_snapshot_verify(paths=["$..KmsKeyId", "$..KmsKeyIds"])
-    @markers.aws.unknown
+    @markers.aws.validated
+    def test_update_secret_version_stages_current_pending_cycle_custom_stages_3(
+        self, sm_snapshot, secret_name, aws_client
+    ):
+        create_secret_rs = aws_client.secretsmanager.create_secret(
+            Name=secret_name, SecretString="SS"
+        )
+        sm_snapshot.add_transformers_list(
+            sm_snapshot.transform.secretsmanager_secret_id_arn(create_secret_rs, 0)
+        )
+        sm_snapshot.match("create_secret_rs", create_secret_rs)
+
+        version_id_v1 = create_secret_rs["VersionId"]
+
+        put_secret_value_rs = aws_client.secretsmanager.put_secret_value(
+            SecretId=secret_name, SecretString="S1", VersionStages=["PENDING"]
+        )
+        sm_snapshot.match("put_secret_value_res_0", put_secret_value_rs)
+
+        version_id_v2 = put_secret_value_rs["VersionId"]
+
+        list_secret_version_ids_rs = aws_client.secretsmanager.list_secret_version_ids(
+            SecretId=secret_name
+        )
+        sm_snapshot.match("list_secret_version_ids_rs", list_secret_version_ids_rs)
+        versions = list_secret_version_ids_rs["Versions"]
+        assert len(versions) == 2
+
+        get_secret_value_v1_rs = aws_client.secretsmanager.get_secret_value(
+            SecretId=secret_name,
+            VersionId=version_id_v1,
+        )
+        sm_snapshot.match("get_secret_value_v1_rs", get_secret_value_v1_rs)
+        assert get_secret_value_v1_rs["VersionStages"] == ["AWSCURRENT"]
+
+        get_secret_value_v2_rs = aws_client.secretsmanager.get_secret_value(
+            SecretId=secret_name,
+            VersionId=version_id_v2,
+        )
+        sm_snapshot.match("get_secret_value_v2_rs", get_secret_value_v2_rs)
+        assert get_secret_value_v2_rs["VersionStages"] == ["PENDING"]
+
+        update_secret_version_stage_res_1 = aws_client.secretsmanager.update_secret_version_stage(
+            SecretId=secret_name,
+            RemoveFromVersionId=version_id_v1,
+            MoveToVersionId=version_id_v2,
+            VersionStage="AWSCURRENT",
+        )
+        sm_snapshot.match("update_secret_version_stage_res_1", update_secret_version_stage_res_1)
+
+        get_secret_value_v1_rs_1 = aws_client.secretsmanager.get_secret_value(
+            SecretId=secret_name,
+            VersionId=version_id_v1,
+        )
+        sm_snapshot.match("get_secret_value_v1_rs_1", get_secret_value_v1_rs_1)
+        assert get_secret_value_v1_rs_1["VersionStages"] == ["AWSPREVIOUS"]
+
+        get_secret_value_v2_rs_1 = aws_client.secretsmanager.get_secret_value(
+            SecretId=secret_name,
+            VersionId=version_id_v2,
+        )
+        sm_snapshot.match("get_secret_value_v2_rs_1", get_secret_value_v2_rs_1)
+        assert sorted(get_secret_value_v2_rs_1["VersionStages"]) == sorted(
+            ["AWSCURRENT", "PENDING"]
+        )
+
+        update_secret_version_stage_res_2 = aws_client.secretsmanager.update_secret_version_stage(
+            SecretId=secret_name,
+            RemoveFromVersionId=version_id_v2,
+            VersionStage="PENDING",
+        )
+        sm_snapshot.match("update_secret_version_stage_res_2", update_secret_version_stage_res_2)
+
+        get_secret_value_v1_rs_2 = aws_client.secretsmanager.get_secret_value(
+            SecretId=secret_name,
+            VersionId=version_id_v1,
+        )
+        sm_snapshot.match("get_secret_value_v1_rs_2", get_secret_value_v1_rs_2)
+        assert get_secret_value_v1_rs_2["VersionStages"] == ["AWSPREVIOUS"]
+
+        get_secret_value_v2_rs_2 = aws_client.secretsmanager.get_secret_value(
+            SecretId=secret_name,
+            VersionId=version_id_v2,
+        )
+        sm_snapshot.match("get_secret_value_v2_rs_2", get_secret_value_v2_rs_2)
+        assert get_secret_value_v2_rs_2["VersionStages"] == ["AWSCURRENT"]
+
+        delete_secret_res_0 = aws_client.secretsmanager.delete_secret(
+            SecretId=secret_name, ForceDeleteWithoutRecovery=True
+        )
+        sm_snapshot.match("delete_secret_res_0", delete_secret_res_0)
+
+    @markers.snapshot.skip_snapshot_verify(paths=["$..KmsKeyId", "$..KmsKeyIds"])
+    @markers.aws.validated
     def test_non_versioning_version_stages_replacement(self, sm_snapshot, secret_name, aws_client):
         create_secret_rs_0 = aws_client.secretsmanager.create_secret(
             Name=secret_name, SecretString="S0"
@@ -1125,7 +1228,7 @@ def test_non_versioning_version_stages_replacement(self, sm_snapshot, secret_nam
         sm_snapshot.match("delete_secret_res_0", delete_secret_res_0)
 
     @markers.snapshot.skip_snapshot_verify(paths=["$..KmsKeyId", "$..KmsKeyIds"])
-    @markers.aws.unknown
+    @markers.aws.validated
     def test_non_versioning_version_stages_no_replacement(
         self, sm_snapshot, secret_name, aws_client
     ):
@@ -1369,7 +1472,7 @@ def secretsmanager_http_put_secret_value_with_version_val_res(
         assert res_json["VersionStages"] == version_stages
         return res_json
 
-    @markers.aws.unknown
+    @markers.aws.only_localstack  # FIXME: all tests using the internal http utils of this class are only targeting localstack
     def test_update_secret_with_non_provided_client_request_token(self, aws_client, secret_name):
         # Create v0.
         secret_string_v0: str = "secret_string_v0"
@@ -1415,7 +1518,7 @@ def test_update_secret_with_non_provided_client_request_token(self, aws_client,
             version_id_v2,
         )
 
-    @markers.aws.unknown
+    @markers.aws.only_localstack  # FIXME: all tests using the internal http utils of this class are only targeting localstack
     def test_put_secret_value_with_new_custom_client_request_token(self, secret_name, aws_client):
         # Create v0.
         secret_string_v0: str = "MySecretString"
@@ -1466,7 +1569,7 @@ def test_put_secret_value_with_new_custom_client_request_token(self, secret_name
             self.secretsmanager_http_delete_secret(secret_name), secret_name
         )
 
-    @markers.aws.unknown
+    @markers.aws.only_localstack  # FIXME: all tests using the internal http utils of this class are only targeting localstack
     def test_http_put_secret_value_with_duplicate_client_request_token(
         self, secret_name, aws_client
     ):
@@ -1515,7 +1618,7 @@ def test_http_put_secret_value_with_duplicate_client_request_token(
             self.secretsmanager_http_delete_secret(secret_name), secret_name
         )
 
-    @markers.aws.unknown
+    @markers.aws.only_localstack  # FIXME: all tests using the internal http utils of this class are only targeting localstack
     def test_http_put_secret_value_with_non_provided_client_request_token(
         self, secret_name, aws_client
     ):
@@ -1562,7 +1665,7 @@ def test_http_put_secret_value_with_non_provided_client_request_token(
             self.secretsmanager_http_delete_secret(secret_name), secret_name
         )
 
-    @markers.aws.unknown
+    @markers.aws.only_localstack  # FIXME: all tests using the internal http utils of this class are only targeting localstack
     def test_http_put_secret_value_duplicate_req(self, secret_name, aws_client):
         # Create v0.
         secret_string_v0: str = "MySecretString"
@@ -1608,7 +1711,7 @@ def test_http_put_secret_value_duplicate_req(self, secret_name, aws_client):
             self.secretsmanager_http_delete_secret(secret_name), secret_name
         )
 
-    @markers.aws.unknown
+    @markers.aws.only_localstack  # FIXME: all tests using the internal http utils of this class are only targeting localstack
     def test_http_put_secret_value_null_client_request_token_new_version_stages(
         self, secret_name, aws_client
     ):
@@ -1670,7 +1773,7 @@ def test_http_put_secret_value_null_client_request_token_new_version_stages(
             self.secretsmanager_http_delete_secret(secret_name), secret_name
         )
 
-    @markers.aws.unknown
+    @markers.aws.only_localstack  # FIXME: all tests using the internal http utils of this class are only targeting localstack
     def test_http_put_secret_value_custom_client_request_token_new_version_stages(
         self,
         secret_name,
@@ -1739,7 +1842,7 @@ def test_http_put_secret_value_custom_client_request_token_new_version_stages(
             self.secretsmanager_http_delete_secret(secret_name), secret_name
         )
 
-    @markers.aws.unknown
+    @markers.aws.validated
     def test_delete_non_existent_secret_returns_as_if_secret_exists(self, secret_name, aws_client):
         """When ForceDeleteWithoutRecovery=True, AWS responds as if the non-existent secret was successfully deleted."""
         response = aws_client.secretsmanager.delete_secret(
@@ -1750,7 +1853,7 @@ def test_delete_non_existent_secret_returns_as_if_secret_exists(self, secret_nam
         assert response["ARN"] is not None
         assert response["DeletionDate"] is not None
 
-    @markers.aws.unknown
+    @markers.aws.validated
     def test_exp_raised_on_creation_of_secret_scheduled_for_deletion(
         self, sm_snapshot, secret_name, aws_client
     ):
@@ -1775,7 +1878,7 @@ def test_exp_raised_on_creation_of_secret_scheduled_for_deletion(
             aws_client.secretsmanager.create_secret(**create_secret_req)
         sm_snapshot.match("invalid_req_ex", invalid_req_ex.value.response)
 
-    @markers.aws.unknown
+    @markers.aws.validated
     def test_can_recreate_delete_secret(self, sm_snapshot, secret_name, aws_client):
         # NOTE: AWS will behave as staged deletion for a small number of seconds (<10).
         # We assume forced deletion is instantaneous, until the precise behaviour is understood.
@@ -1816,13 +1919,7 @@ def test_can_recreate_delete_secret(self, sm_snapshot, secret_name, aws_client):
         aws_client.secretsmanager.delete_secret(**stage_deletion_req)
 
     @markers.aws.validated
-    def test_secret_exists(self, cleanups, aws_client):
-        secret_name = short_uid()
-        cleanups.append(
-            lambda: aws_client.secretsmanager.delete_secret(
-                SecretId=secret_name, ForceDeleteWithoutRecovery=True
-            )
-        )
+    def test_secret_exists(self, secret_name, aws_client):
         description = "Testing secret already exists."
         rs = aws_client.secretsmanager.create_secret(
             Name=secret_name,
@@ -1834,7 +1931,7 @@ def test_secret_exists(self, cleanups, aws_client):
         secret_id = rs["Name"]
         assert len(secret_arn.rpartition("-")[-1]) == 6
 
-        ls = aws_client.secretsmanager.list_secrets()
+        ls = aws_client.secretsmanager.get_paginator("list_secrets").paginate().build_full_result()
         secrets = {
             secret["Name"]: secret["ARN"]
             for secret in ls["SecretList"]
@@ -1858,20 +1955,8 @@ def test_secret_exists(self, cleanups, aws_client):
             == f"The operation failed because the secret {secret_id} already exists."
         )
 
-        # clean up
-        aws_client.secretsmanager.delete_secret(
-            SecretId=secret_name, ForceDeleteWithoutRecovery=True
-        )
-
     @markers.aws.validated
-    def test_secret_exists_snapshots(self, sm_snapshot, cleanups, aws_client):
-        secret_name = short_uid()
-        cleanups.append(
-            lambda: aws_client.secretsmanager.delete_secret(
-                SecretId=secret_name, ForceDeleteWithoutRecovery=True
-            )
-        )
-
+    def test_secret_exists_snapshots(self, secret_name, sm_snapshot, cleanups, aws_client):
         description = "Snapshot testing secret already exists."
         rs = aws_client.secretsmanager.create_secret(
             Name=secret_name,
@@ -1946,13 +2031,13 @@ def test_create_secret_version_from_empty_secret(self, aws_client, snapshot, cle
         response = aws_client.secretsmanager.create_secret(
             Name=f"test-version-{short_uid()}", Description=""
         )
-        snapshot.match("create-empty-secret", response)
-        secret_id = response["ARN"]
         cleanups.append(
             lambda: aws_client.secretsmanager.delete_secret(
                 SecretId=secret_id, ForceDeleteWithoutRecovery=True
             )
         )
+        snapshot.match("create-empty-secret", response)
+        secret_id = response["ARN"]
 
         response = aws_client.secretsmanager.describe_secret(SecretId=secret_id)
         snapshot.match("describe-secret", response)
diff --git a/tests/aws/services/secretsmanager/test_secretsmanager.snapshot.json b/tests/aws/services/secretsmanager/test_secretsmanager.snapshot.json
--- a/tests/aws/services/secretsmanager/test_secretsmanager.snapshot.json
+++ b/tests/aws/services/secretsmanager/test_secretsmanager.snapshot.json
@@ -3777,5 +3777,210 @@
         }
       }
     }
+  },
+  "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_update_secret_version_stages_current_pending_cycle_custom_stages_3": {
+    "recorded-date": "18-01-2024, 04:20:44",
+    "recorded-content": {
+      "create_secret_rs": {
+        "ARN": "arn:aws:secretsmanager:<region>:111111111111:secret:<SecretId-0idx><ArnPart-0idx>",
+        "Name": "<SecretId-0idx>",
+        "VersionId": "<version_uuid:1>",
+        "ResponseMetadata": {
+          "HTTPHeaders": {},
+          "HTTPStatusCode": 200
+        }
+      },
+      "put_secret_value_res_0": {
+        "ARN": "arn:aws:secretsmanager:<region>:111111111111:secret:<SecretId-0idx><ArnPart-0idx>",
+        "Name": "<SecretId-0idx>",
+        "VersionId": "<version_uuid:2>",
+        "VersionStages": [
+          "PENDING"
+        ],
+        "ResponseMetadata": {
+          "HTTPHeaders": {},
+          "HTTPStatusCode": 200
+        }
+      },
+      "list_secret_version_ids_rs": {
+        "ARN": "arn:aws:secretsmanager:<region>:111111111111:secret:<SecretId-0idx><ArnPart-0idx>",
+        "Name": "<SecretId-0idx>",
+        "Versions": [
+          {
+            "CreatedDate": "datetime",
+            "KmsKeyIds": [
+              "DefaultEncryptionKey"
+            ],
+            "VersionId": "<version_uuid:1>",
+            "VersionStages": [
+              "AWSCURRENT"
+            ]
+          },
+          {
+            "CreatedDate": "datetime",
+            "KmsKeyIds": [
+              "DefaultEncryptionKey"
+            ],
+            "VersionId": "<version_uuid:2>",
+            "VersionStages": [
+              "PENDING"
+            ]
+          }
+        ],
+        "ResponseMetadata": {
+          "HTTPHeaders": {},
+          "HTTPStatusCode": 200
+        }
+      },
+      "get_secret_value_v1_rs": {
+        "ARN": "arn:aws:secretsmanager:<region>:111111111111:secret:<SecretId-0idx><ArnPart-0idx>",
+        "CreatedDate": "datetime",
+        "Name": "<SecretId-0idx>",
+        "SecretString": "SS",
+        "VersionId": "<version_uuid:1>",
+        "VersionStages": [
+          "AWSCURRENT"
+        ],
+        "ResponseMetadata": {
+          "HTTPHeaders": {},
+          "HTTPStatusCode": 200
+        }
+      },
+      "get_secret_value_v2_rs": {
+        "ARN": "arn:aws:secretsmanager:<region>:111111111111:secret:<SecretId-0idx><ArnPart-0idx>",
+        "CreatedDate": "datetime",
+        "Name": "<SecretId-0idx>",
+        "SecretString": "S1",
+        "VersionId": "<version_uuid:2>",
+        "VersionStages": [
+          "PENDING"
+        ],
+        "ResponseMetadata": {
+          "HTTPHeaders": {},
+          "HTTPStatusCode": 200
+        }
+      },
+      "update_secret_version_stage_res_1": {
+        "ARN": "arn:aws:secretsmanager:<region>:111111111111:secret:<SecretId-0idx><ArnPart-0idx>",
+        "Name": "<SecretId-0idx>",
+        "ResponseMetadata": {
+          "HTTPHeaders": {},
+          "HTTPStatusCode": 200
+        }
+      },
+      "get_secret_value_v1_rs_1": {
+        "ARN": "arn:aws:secretsmanager:<region>:111111111111:secret:<SecretId-0idx><ArnPart-0idx>",
+        "CreatedDate": "datetime",
+        "Name": "<SecretId-0idx>",
+        "SecretString": "SS",
+        "VersionId": "<version_uuid:1>",
+        "VersionStages": [
+          "AWSPREVIOUS"
+        ],
+        "ResponseMetadata": {
+          "HTTPHeaders": {},
+          "HTTPStatusCode": 200
+        }
+      },
+      "get_secret_value_v2_rs_1": {
+        "ARN": "arn:aws:secretsmanager:<region>:111111111111:secret:<SecretId-0idx><ArnPart-0idx>",
+        "CreatedDate": "datetime",
+        "Name": "<SecretId-0idx>",
+        "SecretString": "S1",
+        "VersionId": "<version_uuid:2>",
+        "VersionStages": [
+          "AWSCURRENT",
+          "PENDING"
+        ],
+        "ResponseMetadata": {
+          "HTTPHeaders": {},
+          "HTTPStatusCode": 200
+        }
+      },
+      "update_secret_version_stage_res_2": {
+        "ARN": "arn:aws:secretsmanager:<region>:111111111111:secret:<SecretId-0idx><ArnPart-0idx>",
+        "Name": "<SecretId-0idx>",
+        "ResponseMetadata": {
+          "HTTPHeaders": {},
+          "HTTPStatusCode": 200
+        }
+      },
+      "get_secret_value_v1_rs_2": {
+        "ARN": "arn:aws:secretsmanager:<region>:111111111111:secret:<SecretId-0idx><ArnPart-0idx>",
+        "CreatedDate": "datetime",
+        "Name": "<SecretId-0idx>",
+        "SecretString": "SS",
+        "VersionId": "<version_uuid:1>",
+        "VersionStages": [
+          "AWSPREVIOUS"
+        ],
+        "ResponseMetadata": {
+          "HTTPHeaders": {},
+          "HTTPStatusCode": 200
+        }
+      },
+      "get_secret_value_v2_rs_2": {
+        "ARN": "arn:aws:secretsmanager:<region>:111111111111:secret:<SecretId-0idx><ArnPart-0idx>",
+        "CreatedDate": "datetime",
+        "Name": "<SecretId-0idx>",
+        "SecretString": "S1",
+        "VersionId": "<version_uuid:2>",
+        "VersionStages": [
+          "AWSCURRENT"
+        ],
+        "ResponseMetadata": {
+          "HTTPHeaders": {},
+          "HTTPStatusCode": 200
+        }
+      },
+      "delete_secret_res_0": {
+        "ARN": "arn:aws:secretsmanager:<region>:111111111111:secret:<SecretId-0idx><ArnPart-0idx>",
+        "DeletionDate": "datetime",
+        "Name": "<SecretId-0idx>",
+        "ResponseMetadata": {
+          "HTTPHeaders": {},
+          "HTTPStatusCode": 200
+        }
+      }
+    }
+  },
+  "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_rotate_secret_invalid_lambda_arn": {
+    "recorded-date": "15-03-2024, 09:20:58",
+    "recorded-content": {
+      "create_secret": {
+        "ARN": "arn:aws:secretsmanager:<region>:111111111111:secret:<SecretId-0idx><ArnPart-0idx>",
+        "Name": "<SecretId-0idx>",
+        "VersionId": "<version_uuid:1>",
+        "ResponseMetadata": {
+          "HTTPHeaders": {},
+          "HTTPStatusCode": 200
+        }
+      },
+      "rotate_secret_invalid_arn_exc": {
+        "Error": {
+          "Code": "AccessDeniedException",
+          "Message": "Secrets Manager cannot invoke the specified Lambda function. Ensure that the function policy grants access to the principal secretsmanager.amazonaws.com."
+        },
+        "ResponseMetadata": {
+          "HTTPHeaders": {},
+          "HTTPStatusCode": 400
+        }
+      },
+      "describe_secret": {
+        "ARN": "arn:aws:secretsmanager:<region>:111111111111:secret:<SecretId-0idx><ArnPart-0idx>",
+        "CreatedDate": "datetime",
+        "LastChangedDate": "datetime",
+        "Name": "<SecretId-0idx>",
+        "VersionIdsToStages": {
+          "<version_uuid:1>": [
+            "AWSCURRENT"
+          ]
+        },
+        "ResponseMetadata": {
+          "HTTPHeaders": {},
+          "HTTPStatusCode": 200
+        }
+      }
+    }
   }
 }
diff --git a/tests/aws/services/secretsmanager/test_secretsmanager.validation.json b/tests/aws/services/secretsmanager/test_secretsmanager.validation.json
--- a/tests/aws/services/secretsmanager/test_secretsmanager.validation.json
+++ b/tests/aws/services/secretsmanager/test_secretsmanager.validation.json
@@ -1,69 +1,93 @@
 {
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_call_lists_secrets_multiple_times": {
-    "last_validated_date": "2022-08-09T14:47:36+00:00"
+    "last_validated_date": "2024-03-15T08:11:53+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_call_lists_secrets_multiple_times_snapshots": {
     "last_validated_date": "2022-09-28T08:06:28+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_can_recreate_delete_secret": {
-    "last_validated_date": "2022-09-28T08:17:08+00:00"
+    "last_validated_date": "2024-03-15T08:13:48+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_create_and_update_secret[Valid/_+=.@-Name-a1b2]": {
-    "last_validated_date": "2023-04-14T14:43:18+00:00"
+    "last_validated_date": "2024-03-15T08:11:46+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_create_and_update_secret[Valid/_+=.@-Name-a1b2c3-]": {
-    "last_validated_date": "2023-04-14T14:43:20+00:00"
+    "last_validated_date": "2024-03-15T08:11:48+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_create_and_update_secret[Valid/_+=.@-Name]": {
-    "last_validated_date": "2023-04-14T14:43:15+00:00"
+    "last_validated_date": "2024-03-15T08:11:45+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_create_and_update_secret[s-c64bdc03]": {
-    "last_validated_date": "2023-04-14T14:43:13+00:00"
+    "last_validated_date": "2024-03-15T08:11:43+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_create_multi_secrets": {
-    "last_validated_date": "2022-08-09T14:48:10+00:00"
+    "last_validated_date": "2024-03-15T08:12:00+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_create_multi_secrets_snapshot": {
     "last_validated_date": "2022-09-28T08:10:00+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_create_secret_version_from_empty_secret": {
-    "last_validated_date": "2023-09-05T20:19:06+00:00"
+    "last_validated_date": "2024-03-15T08:14:58+00:00"
+  },
+  "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_delete_non_existent_secret_returns_as_if_secret_exists": {
+    "last_validated_date": "2024-03-15T08:13:15+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_exp_raised_on_creation_of_secret_scheduled_for_deletion": {
-    "last_validated_date": "2022-09-28T08:16:20+00:00"
+    "last_validated_date": "2024-03-15T08:13:16+00:00"
+  },
+  "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_get_random_exclude_characters_and_symbols": {
+    "last_validated_date": "2024-03-15T08:12:01+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_invalid_secret_name[ Inv *?!]Name\\\\-]": {
-    "last_validated_date": "2022-09-28T08:11:37+00:00"
+    "last_validated_date": "2024-03-15T08:12:44+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_invalid_secret_name[ Inv Name]": {
-    "last_validated_date": "2022-09-28T08:11:27+00:00"
+    "last_validated_date": "2024-03-15T08:12:35+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_invalid_secret_name[ Inv*Name? ]": {
-    "last_validated_date": "2022-09-28T08:11:32+00:00"
+    "last_validated_date": "2024-03-15T08:12:39+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_invalid_secret_name[Inv Name]": {
-    "last_validated_date": "2022-09-28T08:11:22+00:00"
+    "last_validated_date": "2024-03-15T08:12:30+00:00"
+  },
+  "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_last_accessed_date": {
+    "last_validated_date": "2024-03-15T08:12:46+00:00"
+  },
+  "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_last_updated_date": {
+    "last_validated_date": "2024-03-15T08:12:47+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_no_client_request_token[CreateSecret]": {
-    "last_validated_date": "2023-05-12T10:09:22+00:00"
+    "last_validated_date": "2024-03-15T08:14:56+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_no_client_request_token[PutSecretValue]": {
-    "last_validated_date": "2023-05-12T10:09:24+00:00"
+    "last_validated_date": "2024-03-15T08:14:58+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_no_client_request_token[RotateSecret]": {
-    "last_validated_date": "2023-05-12T10:09:23+00:00"
+    "last_validated_date": "2024-03-15T08:14:57+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_no_client_request_token[UpdateSecret]": {
-    "last_validated_date": "2023-05-12T10:09:23+00:00"
+    "last_validated_date": "2024-03-15T08:14:57+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_non_versioning_version_stages_no_replacement": {
-    "last_validated_date": "2022-09-28T08:15:24+00:00"
+    "last_validated_date": "2024-03-15T08:13:15+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_non_versioning_version_stages_replacement": {
-    "last_validated_date": "2022-09-28T08:14:57+00:00"
+    "last_validated_date": "2024-03-15T08:13:14+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_put_secret_value_with_version_stages": {
-    "last_validated_date": "2022-09-28T08:10:50+00:00"
+    "last_validated_date": "2024-03-15T08:12:26+00:00"
+  },
+  "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_resource_policy": {
+    "last_validated_date": "2024-03-15T08:12:02+00:00"
+  },
+  "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_rotate_secret_invalid_lambda_arn": {
+    "last_validated_date": "2024-03-15T10:11:13+00:00"
+  },
+  "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_rotate_secret_with_lambda_success": {
+    "last_validated_date": "2024-03-15T08:12:22+00:00"
+  },
+  "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_secret_exists": {
+    "last_validated_date": "2024-03-15T08:14:33+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_rotate_secret_with_lambda_success[None]": {
     "last_validated_date": "2024-03-14T21:03:56+00:00"
@@ -72,30 +96,33 @@
     "last_validated_date": "2024-03-14T21:03:47+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_secret_exists_snapshots": {
-    "last_validated_date": "2022-10-27T15:29:07+00:00"
+    "last_validated_date": "2024-03-15T08:14:55+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_secret_not_found": {
-    "last_validated_date": "2022-09-28T08:05:07+00:00"
+    "last_validated_date": "2024-03-15T08:11:49+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_update_secret_description": {
-    "last_validated_date": "2022-09-28T08:12:12+00:00"
+    "last_validated_date": "2024-03-15T08:12:49+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_update_secret_version_stages_current_pending": {
-    "last_validated_date": "2022-09-28T08:13:21+00:00"
+    "last_validated_date": "2024-03-15T08:13:02+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_update_secret_version_stages_current_pending_cycle": {
-    "last_validated_date": "2022-09-28T08:13:41+00:00"
+    "last_validated_date": "2024-03-15T08:13:05+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_update_secret_version_stages_current_pending_cycle_custom_stages_1": {
-    "last_validated_date": "2022-09-28T08:14:08+00:00"
+    "last_validated_date": "2024-03-15T08:13:07+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_update_secret_version_stages_current_pending_cycle_custom_stages_2": {
-    "last_validated_date": "2022-09-28T08:14:32+00:00"
+    "last_validated_date": "2024-03-15T08:13:10+00:00"
+  },
+  "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_update_secret_version_stages_current_pending_cycle_custom_stages_3": {
+    "last_validated_date": "2024-03-15T08:13:13+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_update_secret_version_stages_current_previous": {
-    "last_validated_date": "2022-09-28T08:13:01+00:00"
+    "last_validated_date": "2024-03-15T08:13:01+00:00"
   },
   "tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_update_secret_version_stages_return_type": {
-    "last_validated_date": "2022-09-28T08:12:32+00:00"
+    "last_validated_date": "2024-03-15T08:12:50+00:00"
   }
 }