secret manager password rotation for RDS

Question

We have configured Amazon RDS with High Availability (Multi-AZ) and a DR region using a Read Replica. We are planning to enable AWS Secrets Manager password rotation with a 90-day rotation schedule.

However, when the rotation process is triggered, the associated Lambda function is invoked but fails, and the database password is not updated. As a result, the password rotation does not complete successfully.

We observed that password rotation works successfully when only the primary RDS instance is deployed without a Read Replica. The issue occurs only after the Read Replica configuration is introduced.

Could you please suggest the recommended approach or best practice for enabling and managing RDS password rotation through AWS Secrets Manager in an environment that includes Read Replicas and a DR setup?

Taka · Answer

This specific limitation is explicitly stated on the official AWS blog "[Automate Amazon RDS credential rotation with AWS Secrets Manager for primary instances with read replicas | AWS Database Blog](https://aws.amazon.com/jp/blogs/database/automate-amazon-rds-credential-rotation-with-aws-secrets-manager-for-primary-instances-with-read-replicas/)".
> When using Secrets Manager to manage your master user passwords, you cannot create new read replicas for your database instance.

Discussions among users on AWS re:Post also explain the situation as follows:

[Read replica of RDS with Secrets Manager integration | AWS re:Post](https://repost.aws/questions/QUdLdC7_nNRWm93ScLB2WO5Q/read-replica-of-rds-with-secrets-manager-integration)
>  are correct that creating a read replica is generally not supported when the source DB or DB cluster manages credentials with AWS Secrets Manager, with the exception of RDS for SQL Server.

The standard rotation Lambda function for Secrets Manager (the template provided by AWS) was not originally designed with read-replica configurations in mind. While RDS automatically propagates password changes to replicas via the replication stream in a primary-only setup, the standard rotation Lambda is not built to wait for or verify this propagation; consequently, there are multiple reports of failures—such as during the verification phase—when used in configurations that include read replicas.

There is an official AWS blog post and solution specifically addressing this use case:

[Automate Amazon RDS credential rotation with AWS Secrets Manager for primary instances with read replicas | AWS Database Blog](https://aws.amazon.com/jp/blogs/database/automate-amazon-rds-credential-rotation-with-aws-secrets-manager-for-primary-instances-with-read-replicas/)

There is yet another official AWS solution for read replicas in the DR region.

[How to automate replication of secrets in AWS Secrets Manager across AWS Regions | AWS Security Blog](https://aws.amazon.com/jp/blogs/security/how-to-automate-replication-of-secrets-in-aws-secrets-manager-across-aws-regions/)

secret manager password rotation for RDS

Add your answer

Relevant content