Question

A company stores the master credentials for an Amazon RDS for PostgreSQL database in AWS Secrets Manager. The database runs in private subnets of a VPC with no internet gateway and no NAT gateway. The security team enables automatic rotation using the AWS-provided rotation Lambda function. Rotation consistently fails, and CloudWatch Logs show the Lambda function timing out when it attempts to reach the Secrets Manager service. What should the team do to make rotation succeed?

Accepted Answer

Create an interface VPC endpoint for Secrets Manager and configure the rotation Lambda function to run in the VPC's private subnets with access to that endpoint

Answer

Attach an internet gateway to the VPC and add a public route so the rotation Lambda function can reach the public Secrets Manager endpoint

Answer

Disable automatic rotation and instead rotate the RDS credentials manually every 30 days using the AWS CLI from an on-premises host

Answer

Grant the rotation Lambda function's execution role the SecretsManagerReadWrite managed policy to resolve the timeout