Secrets Manager Rotation Pattern

Automatic secret rotation is a cornerstone of DevOps security posture. Instead of manual credential rotation (which is error-prone and often skipped), Secrets Manager can invoke a Lambda function on a schedule to rotate credentials without downtime.

In this lab you'll act as the security engineer for a production RDS deployment. You will:

• Create a database secret in Secrets Manager with a realistic JSON structure (username, password, host, port, dbname)
• Author a Python-based rotation Lambda function that implements the four-step rotation lifecycle (createSecret, setSecret, testSecret, finishSecret)
• Create the IAM execution role that allows Secrets Manager to invoke the rotation Lambda
• Enable managed rotation on a 30-day schedule, then trigger an immediate rotation on demand
• Retrieve the secret at AWSCURRENT, AWSPENDING, and AWSPREVIOUS version stages to prove rotation actually cycled the credential
• Document the rotation pattern, Lambda anatomy, and version lifecycle for your operations runbook

No RDS instance is provisioned. The rotation Lambda updates the secret value itself, simulating the full lifecycle so you can focus on the Secrets Manager mechanics without database overhead.