Question

A company uses AWS Secrets Manager to store database credentials for an Amazon RDS for PostgreSQL instance. A DevOps engineer configured automatic rotation with a custom Lambda rotation function using the four-step rotation model. After deploying, the rotation runs but applications intermittently fail to authenticate immediately after each rotation event, receiving 'password authentication failed' errors for a brief period. Investigation shows the Lambda function updates the password in RDS during the createSecret step. Which change to the rotation function will resolve the intermittent authentication failures?

Accepted Answer

Move the logic that changes the database password from the createSecret step to the setSecret step, and only mark the AWSCURRENT stage after the finishSecret step completes.

Answer

Increase the Lambda function timeout and memory so the rotation completes faster and reduces the window of failed authentications.

Answer

Configure applications to retrieve the secret using the AWSPREVIOUS version stage so they always use the older working credentials.

Answer

Reduce the rotation schedule frequency from every 30 days to every 90 days to minimize how often the failures can occur.