Question

A company stores database credentials in AWS Secrets Manager with automatic rotation enabled via a Lambda function. During a rotation, application instances began failing authentication intermittently for several minutes before recovering. The security engineer must ensure applications always retrieve valid credentials during rotation. Which approach correctly explains and resolves this behavior?

Accepted Answer

Applications should retrieve the secret using the AWSCURRENT version stage, and the rotation Lambda must complete the setSecret and testSecret steps before finishSecret promotes the new version to AWSCURRENT.

Answer

Applications should retrieve the secret using the AWSPENDING version stage so they always receive the newest credential value immediately as rotation begins.

Answer

Disable automatic rotation and rely on a manual rotation schedule to avoid any window where credentials are invalid.

Answer

Increase the Secrets Manager cache TTL in the application so it never re-reads the secret during the rotation window.