AWS Builder Center

Builder Center

Zero-Downtime Secret Rotation Using AWS Secrets Manager and AWS Lambda

Zero-Downtime Secret Rotation Using AWS Secrets Manager and AWS Lambda

Learn how to configure automatic, zero-downtime secret rotation using AWS Secrets Manager and AWS Lambda with alternating user strategies.

Mekanath

Hardcoded or static credentials are one of the most common security vulnerabilities in modern applications. AWS Secrets Manager enables automatic credential rotation on scheduled intervals (such as every 30 or 90 days).
However, updating a password live can cause transient database errors or connection drops if done incorrectly. Implementing zero-downtime rotation ensures uninterrupted application traffic during scheduled key changes.

The Four-Step Rotation Lifecycle

When AWS Secrets Manager triggers a rotation, it executes a four-step lifecycle using an AWS Lambda function:
  1. createSecret: Generates a new secret string and labels it as AWSPENDING.
  2. setSecret: Updates the target database, service, or API with the new credential.
  3. testSecret: Verifies that the new AWSPENDING credential functions correctly.
  4. finishSecret: Promotes the new version to AWSCURRENT and cleans up old staging labels.

Strategy: Alternating Users

To achieve zero downtime, use the Alternating Users Strategy rather than Single User rotation:
  • User A & User B: Secrets Manager manages two distinct application database users.
  • Active State: While User A serves active production traffic, Secrets Manager updates User B's password in the background.
  • Switch: Secrets Manager tests User B and then points application reads to User B, leaving zero window for failed connections.
# secrets-manager# aws-lambda# security# databases# devops
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article