Free AWS Security Whitepaper
    Toc Consulting Logo
    Glossary

    Secrets Rotation

    Data Protection

    Secrets Rotation is the practice of automatically changing credentials on a regular schedule. AWS Secrets Manager provides native rotation support for many secret types.

    Native Rotation Support

    • RDS Databases: MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, Aurora (single-user and alternating-user strategies)
    • Redshift: cluster admin passwords
    • DocumentDB: database passwords
    • Custom Secrets: Lambda rotation function for any secret type (API keys, OAuth tokens, SSH keys)

    Rotation Strategies

    • Single-user: update the password for one user; brief interruption during rotation
    • Alternating-user: maintain two users, rotate between them; zero downtime
    • Managed rotation (since 2024): managed rotation for RDS without Lambda functions

    Best Practices

    • Rotate every 30-90 days depending on sensitivity
    • Applications should always fetch secrets at runtime (not cache indefinitely)
    • Test rotation in non-production environments first
    • Monitor rotation failures with CloudWatch alarms

    Related AWS Services

    SECRETSRDSLAMBDA

    Related Content

    Secrets Manager Security CardSecrets Manager vs Parameter Store vs Vault

    Related Terms

    Secrets Management

    The practice of securely storing, accessing, and rotating sensitive data like API keys, database passwords, and tokens using services like AWS Secrets Manager.

    Credential Rotation

    The practice of regularly replacing access keys, passwords, and secrets with new values to limit the window of exposure if a credential is compromised.

    Credential Compromise

    When AWS access keys, session tokens, or passwords are exposed to unauthorized parties - the #1 most common AWS security incident.

    RDS Security

    Security practices for Amazon RDS including encryption, network isolation, IAM authentication, automated backups, and audit logging.

    Microservices SecurityAWS Audit Manager

    KloudSec, built by the team behind Toc Consulting

    See Secrets Rotation checked automatically, continuously

    What you just read is a manual, one-time check. KloudSec runs this and 400+ more automated checks across 90+ AWS services, continuously, agentless, live in about 5 minutes.

    Try KloudSec free

    Toc Consulting: AWS Security & Cloud Architecture

    Securing your AWS estate?

    Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.

    Book a discovery callhello@tocconsulting.fr