Question

A financial services company stores an Amazon RDS for PostgreSQL master credential in AWS Secrets Manager. Security requires the secret to rotate automatically every 30 days. The database resides in private subnets with no internet access and only allows inbound connections from the application security group. After enabling rotation using the AWS-provided rotation Lambda function, rotation consistently fails with a timeout during the setSecret step. What is the MOST likely cause and correct remediation?

Accepted Answer

The rotation Lambda function is not deployed in the same VPC and subnets as the database and lacks a security group permitted to reach the RDS instance; configure the Lambda VPC settings and add its security group to the DB's inbound rules.

Answer

The secret is missing a resource-based policy allowing Secrets Manager to invoke rotation; attach a policy granting secretsmanager:RotateSecret to the service principal.

Answer

Automatic rotation requires a customer managed KMS key; switch the secret from the AWS managed key to a customer managed key to enable the rotation workflow.

Answer

The RDS instance must have a public endpoint so the rotation Lambda can connect over the internet; enable public accessibility on the DB instance.