Secrets Manager Rotation Template

Secrets Manager Rotation Template

Rotating database credentials is a best practice that most teams skip because the wiring is painful. This CloudFormation template handles everything: the Secrets Manager secret, the rotation Lambda, the IAM role, the VPC configuration, and the rotation schedule.

What Gets Deployed

• Secrets Manager Secret — stores database credentials with an optional KMS CMK for encryption at rest
• Rotation Lambda — implements the four-step rotation (createSecret, setSecret, testSecret, finishSecret) for both MySQL and Postgres. Supports single-user and alternating-user strategies.
• IAM Role — least-privilege role for the rotation Lambda with permissions scoped to the specific secret ARN
• VPC Lambda Config — deploys the Lambda into the same VPC/subnets as your RDS instance with a dedicated security group allowing only port 3306/5432
• Rotation Schedule — configurable rotation interval (default 30 days) with optional immediate rotation on first deploy

Developer Experience

Parameters accept your RDS endpoint, port, DB name, initial username and password — the template handles the rest. A test-rotation.sh script validates the rotator by manually invoking each step of the rotation process and confirming the new credentials connect successfully.

What You Get

• secrets-rotation.yaml — CloudFormation template
• rotator/ — Python Lambda source (single-user and alternating-user variants)
• test-rotation.sh — end-to-end rotation test script
• README.md — parameter reference, VPC requirements, and production checklist

Requirements

RDS instance must be in a VPC. Lambda and RDS must share a VPC or be peered. Works with RDS, RDS Proxy, and Aurora (MySQL-compatible and Postgres-compatible).