MultiUser rotations are incompatible with RDS Proxy about aws-secrets-manager-rotation-lambdas HOT 12 CLOSED

Hi ahammond. These samples are provided to customers to freely modify to fit their particular use case. This change is not something that we believe should be part of the generic template. I will note that Secrets Manager maintains the history and the previous versions can be retrieved by using the AWSPREVIOUS staging label.

from aws-secrets-manager-rotation-lambdas.

The current recommendation from RDS Proxy is to investigate using IAM-based authentication (which wouldn't involve Secrets Manager)

Who is this recommendation directed at? I'm a little confused because I don't think RDS Proxy supports IAM between the proxy and the database. The only option when setting up the proxy is to pick a Secrets Manager secret and an IAM role which has permission to read the secret.

from aws-secrets-manager-rotation-lambdas.

By adding

formerUser: string;
formerPassword: string;

to the secret, it exposes the information necessary for people to build workarounds, including the AWS RDS team, should they decide to have RDS Proxies support multi-user rotations.

from aws-secrets-manager-rotation-lambdas.

@ahammond

Thank you for bringing this to our attention.

We are working on appropriately prioritizing development on this issue.

from aws-secrets-manager-rotation-lambdas.

@adithyasolai already wrote the PR...

from aws-secrets-manager-rotation-lambdas.

@ahammond Yes, we will certainly take your implementation into consideration.

However, there is extra lift in ensuring that every newly-generated Rotation Lambda is updated with this change for all customers.

from aws-secrets-manager-rotation-lambdas.

from aws-secrets-manager-rotation-lambdas.

from aws-secrets-manager-rotation-lambdas.

@mrgrain reached out internally about this, and I apologize for misunderstanding the problem and overlooking the CDK related link. Let me follow up with the team on Monday for this and see what we can do to help.

from aws-secrets-manager-rotation-lambdas.

Hi ahammond. I was able to catch up with the RDS Proxy team and unfortunately multiuser rotations are unsupported with RDS Proxy at this time. They will be working on updating public documentation to make the details around this more clear.

The current recommendation from RDS Proxy is to investigate using IAM-based authentication (which wouldn't involve Secrets Manager), or switch to single user rotation.

from aws-secrets-manager-rotation-lambdas.

Sooo... RDS Proxy could detect when the username is toggling back between foo and foo_clone and auto-detect multiuser rotations. It could literally be that easy.

from aws-secrets-manager-rotation-lambdas.

The current recommendation from RDS Proxy is to investigate using IAM-based authentication (which wouldn't involve Secrets Manager)

Who is this recommendation directed at? I'm a little confused because I don't think RDS Proxy supports IAM between the proxy and the database. The only option when setting up the proxy is to pick a Secrets Manager secret and an IAM role which has permission to read the secret.

@instantdelay were you able to get any update on this? Looks like we can not just skip Secrets Manager with Proxy

from aws-secrets-manager-rotation-lambdas.