SqlServer rotation not respecting EXCLUDE_CHARACTERS about aws-secrets-manager-rotation-lambdas HOT 6 CLOSED

Hi @BlueMaegi - when was this lambda deployed that began causing the issue? I just tried reproducing it myself and it's excluding the characters in a large character length password. Wondering if something else changed the password without the exclusion given this one hasn't ran since Nov 2023.

from aws-secrets-manager-rotation-lambdas.

The lambda was created in May 2023 and has not been touched since. It was autogenerated the first time we spun up an RDS instance with SecretsManager rotation enabled. We've never "deployed" it from our own code.

My thought was to delete it, and tear down all the associated RDS instances to start from scratch. But we lack knowledge on what drives/creates the rotation lambdas to be sure that such a process would even work.

from aws-secrets-manager-rotation-lambdas.

Could you please provide us with exact code that the rotation lambda is running?

Steps

• Navigate to the secret detail in AWS Secrets Manager console
• Select Rotation tab
• Click on the link below the Lambda rotation function section
• In the Function overview hit the Download button and select Download function code .zip
• Extract archive locally and please attach lambda_function.py to this issue.

from aws-secrets-manager-rotation-lambdas.

On the rotation tab, it says the following:
"Amazon RDS (rds) manages rotation for this secret, so you don't need to choose a Lambda rotation function."

Regardless, I've attached the file from the autogenerated function, which is probably not running anymore.

lambda_function.txt

from aws-secrets-manager-rotation-lambdas.

There are actually two distinct concepts:

• Managed rotation
• Rotation lambdas

In your case the secret is rotated by RDS (managed rotation), but you're trying to change parameters of rotation lambda that is not being used (at least for secret you reference here).

from aws-secrets-manager-rotation-lambdas.

@BlueMaegi the managed rotations doesn't allow user to specify criteria for a random password generation. If you really need control over the characters used in password you'll need to switch your secret to the rotation lambdas (away from managed rotation).

I'll close the ticket now, but feel free to re-open.

from aws-secrets-manager-rotation-lambdas.