Comments (12)
Hi ahammond. These samples are provided to customers to freely modify to fit their particular use case. This change is not something that we believe should be part of the generic template. I will note that Secrets Manager maintains the history and the previous versions can be retrieved by using the AWSPREVIOUS staging label.
from aws-secrets-manager-rotation-lambdas.
The current recommendation from RDS Proxy is to investigate using IAM-based authentication (which wouldn't involve Secrets Manager)
Who is this recommendation directed at? I'm a little confused because I don't think RDS Proxy supports IAM between the proxy and the database. The only option when setting up the proxy is to pick a Secrets Manager secret and an IAM role which has permission to read the secret.
from aws-secrets-manager-rotation-lambdas.
By adding
formerUser: string;
formerPassword: string;
to the secret, it exposes the information necessary for people to build workarounds, including the AWS RDS team, should they decide to have RDS Proxies support multi-user rotations.
from aws-secrets-manager-rotation-lambdas.
Thank you for bringing this to our attention.
We are working on appropriately prioritizing development on this issue.
from aws-secrets-manager-rotation-lambdas.
@adithyasolai already wrote the PR...
from aws-secrets-manager-rotation-lambdas.
@ahammond Yes, we will certainly take your implementation into consideration.
However, there is extra lift in ensuring that every newly-generated Rotation Lambda is updated with this change for all customers.
from aws-secrets-manager-rotation-lambdas.
from aws-secrets-manager-rotation-lambdas.
from aws-secrets-manager-rotation-lambdas.
@mrgrain reached out internally about this, and I apologize for misunderstanding the problem and overlooking the CDK related link. Let me follow up with the team on Monday for this and see what we can do to help.
from aws-secrets-manager-rotation-lambdas.
Hi ahammond. I was able to catch up with the RDS Proxy team and unfortunately multiuser rotations are unsupported with RDS Proxy at this time. They will be working on updating public documentation to make the details around this more clear.
The current recommendation from RDS Proxy is to investigate using IAM-based authentication (which wouldn't involve Secrets Manager), or switch to single user rotation.
from aws-secrets-manager-rotation-lambdas.
Sooo... RDS Proxy could detect when the username is toggling back between foo
and foo_clone
and auto-detect multiuser rotations. It could literally be that easy.
from aws-secrets-manager-rotation-lambdas.
The current recommendation from RDS Proxy is to investigate using IAM-based authentication (which wouldn't involve Secrets Manager)
Who is this recommendation directed at? I'm a little confused because I don't think RDS Proxy supports IAM between the proxy and the database. The only option when setting up the proxy is to pick a Secrets Manager secret and an IAM role which has permission to read the secret.
@instantdelay were you able to get any update on this? Looks like we can not just skip Secrets Manager with Proxy
from aws-secrets-manager-rotation-lambdas.
Related Issues (20)
- Feature Request: Redshift Serverless Namespace admin user rotation HOT 2
- MySQL MultiUser lambda cannot rotate users with host different than default '%' HOT 3
- PostgreSQL SingleUser rotation, isn't working with RDS-Proxy HOT 1
- SecretsManagerRDSPostgreSQLRotationMultiUser doesn't support RDS Aurora Postgres HOT 1
- MySQL MultiUser Increase Username limit from 16 to 32 HOT 5
- secrets-manager automatic rotation for aws msk HOT 1
- SecretsManagerRDSMySQLRotationSingleUser error when require SSL HOT 4
- Name of IAM role not returned from AWS::SecretsManager::RotationSchedule HOT 1
- Aurora-mysql rotation fix HOT 1
- Update images to latest version of Python HOT 4
- Updating python enginefrom 3.7 to 3.11 Runtime.ImportModuleError HOT 3
- cx_Oracle has a major new release under a new name python-oracledb HOT 2
- MySQL and PostgreSQL support for aurora is inconsistent. HOT 2
- Secrets rotation fails for Oracle RDS with SSL or NNE HOT 4
- SqlServer rotation not respecting EXCLUDE_CHARACTERS HOT 6
- Cloud Formation Rotation type is missing for Elasticache Rotation Lambda HOT 1
- Getting cryptography' package is required while rotating secrets manager rds password HOT 5
- Include requirements.txt for each folder HOT 2
- SecretsManagerRDSMySQLRotationMultiUser through CloudFormation: KeyError 'masterarn' HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from aws-secrets-manager-rotation-lambdas.