Question

A developer builds a high-traffic Lambda function that retrieves a database password stored in AWS Secrets Manager. During load testing, the function starts throwing throttling errors, and CloudWatch shows a large number of GetSecretValue API calls—one per invocation. The secret rotates only once every 30 days. What is the MOST efficient way to reduce the number of Secrets Manager API calls while still using the current credentials?

Accepted Answer

Use the AWS Secrets Manager caching library (client-side cache) to store the retrieved secret in memory and refresh it only periodically.

Answer

Copy the password into a Lambda environment variable at deployment time and read it from there on each invocation.

Answer

Disable automatic rotation on the secret so that GetSecretValue calls are no longer rate limited.

Answer

Request a service quota increase for Secrets Manager GetSecretValue so the function can call it on every invocation.