Question

A company stores its Amazon RDS for PostgreSQL master credentials in AWS Secrets Manager and has enabled automatic rotation every 30 days using the AWS-provided rotation Lambda function. The RDS instance runs in private subnets of a VPC. After enabling rotation, the DevOps team finds that the secret status shows the rotation failed, and CloudWatch Logs for the rotation Lambda show timeout errors when the function attempts to reach the Secrets Manager service endpoint. What is the MOST likely cause and the correct remediation?

Accepted Answer

The rotation Lambda is not configured in the VPC; attach the Lambda to the same VPC and private subnets and add a VPC interface endpoint (or NAT gateway route) so it can reach the Secrets Manager endpoint.

Answer

The secret's resource policy denies the Lambda access; add a resource-based policy on the secret granting secretsmanager:GetSecretValue to the RDS service principal.

Answer

The rotation interval of 30 days exceeds the maximum allowed; reduce the rotation window to 7 days so the Lambda has time to complete.

Answer

KMS encryption is blocking the rotation; disable customer managed key encryption on the secret so the Lambda can decrypt it without additional permissions.