AWS Builder Center is the official home for builders on AWS. Share and read what others are working on, follow people who inspire you, explore training and workshops, and find tools to support what you're building.
RDS not working from Lambda code after password secret rotation
I connect to my db no problems until the secret rotates.
I have a RDS MySql db. I connect to this from my smart phone app -> API -> Lambda fct -> RDS.
I get the password to the db from the AWS Secrets Manager.
var dbUser = secretsManagerService.GetSecretAsync().GetAwaiter().GetResult();
It is all working perfectly as expected.
The secret rotates after 7 days. My mobile app can no longer access the database.
I then use MySql Workbench to access the database, it demands the new password, I manually get the password from the secrets manager and copy and paste into Workbench, I can now connect to the database.
I go back to my mobile app and it is now working again business as usual.
My mobile app needs to take the new password everytime it rotates without intervention.
- Language
- English
asked 10 months ago268 views
- Newest
- Most votes
- Most comments
Hello.
Is there any code on the Lambda side that caches SecretsManager values?
In that case, try shortening the cache period or changing the code so that if a connection error occurs due to an incorrect password, the secret is retrieved from SecretsManager again.
https://docs.aws.amazon.com/lambda/latest/dg/with-secrets-manager.html
The password you are rotating is the root password for the database. This password will have full access to this RDS cluster. Ideally, you should create a new password for the database with minimal permissions and use that with your applications. You can also save this new password in a secret manager and use that in your application.
And are you saying not to rotate the new password?
Relevant content
asked 2 months ago
asked 2 years ago
asked 2 years ago
This was my first journey through the AWS-land of Secrets. Mostly just using C# sample code so I think I'm keeping it as simple as possible to make it work. I don't recall using any kind of cache , not to say there isn't some default there. I would imagine since I'm on the bottome tier if not free tier that it goes out of memory really quickly, and I have mostly only me doing the testing atm, therefore I would have thought it's getting the secret fresh almost every time. Like it's fine tonight , but when I start back tomorrow I have this problem.