Ravi Sir's Cards › AWS
Automatic rotation
This revision card explains Automatic rotation. It starts from the need that static DB passwords for years are a breach waiting to happen. It describes rotation uses a Lambda that creates a new password, updates DB and secret versions (AWSPENDING , then AWSCURRENT). The how-to section covers how to enable rotation schedule; test in staging; monitor rotation failures in CloudWatch. An example on the card is every 30 days the clinic DB password changes without redeploying the app.
Read card text
What this card says
Why do we need it?
Static DB passwords for years are a breach waiting to happen.
What is it?
Rotation uses a Lambda that creates a new password, updates DB and secret versions (AWSPENDING → AWSCURRENT).
AWSCURRENT
How to do it
Enable rotation schedule; test in staging; monitor rotation failures in CloudWatch.
Example
Every 30 days the clinic DB password changes without redeploying the app.