An AWS lambda function to rotate Tailscale auth keys store in a secret store
Tailscale Auth Keys have an expiry date, after which they can't be used to add new clients to the tailnet.
The best practice with Tailscale is to create an OAuth Client and use those to authenticate devices. You can use OAuth clients to directly authenticate devices, but then you have static credentials which can be used forever if they're exfiltrated.
The solution is to create an OAuth client, then create an auth key that expires to authorize new devices. If you follow that path, you can use this lambda to periodically rotate your auth keys.