AWS Secrets Manager
Automatic Rotation: Zero-Downtime Security for Database Credentials
The Ingredients
The Secret Vault
AWS Secrets Manager stores your DB host, username, and initial password as a JSON object.
The Lambda Rotator
A serverless function that handles the logic of changing the password in the DB and updating the secret.
The Target DB
Amazon RDS, Redshift, or DocumentDB. The resource where credentials must be rotated.
The 4-Step Rotation Process
How AWS ensures security without breaking your application
Create Secret Version
Secrets Manager creates a new version of the secret with a new password, marked as AWSPENDING.
Set Database Password
Lambda uses the AWSPENDING credentials to change the password directly on the database instance.
Test New Credentials
The Lambda function attempts to log in to the DB using the new password to ensure it works correctly.
Finish Rotation
The AWSPENDING label is moved to AWSCURRENT. The old password is now deprecated.