View a markdown version of this page

AWS Secrets Manager rotation function templates - AWS Secrets Manager

Amazon RDS and Amazon Aurora Amazon DocumentDB Amazon Redshift Amazon Timestream for InfluxDB Amazon ElastiCache Active Directory Other types of secrets

AWS Secrets Manager rotation function templates

AWS Secrets Manager provides a set of rotation function templates that help automate the secure management of credentials for various database systems and services. The templates are ready-to-use Lambda functions that implement best practices for credential rotation, helping you maintain your security posture without manual intervention.

The templates support two primary rotation strategies:

Single-user rotation which updates the credentials for a single user.
Alternating-users rotation which maintains two separate users to help eliminate downtime during credential changes.

Secrets Manager also provides a generic template that serves as a starting point for any type of secret.

To use the templates, see:

To write your own rotation function, see Write a rotation function.

Templates

Amazon RDS and Amazon Aurora

Amazon RDS Db2 single user

Template name: SecretsManagerRDSDb2RotationSingleUser
Rotation strategy: Rotation strategy: single user.
SecretString structure: Amazon RDS and Aurora credentials.
Source code: https://github.com/aws-samples/aws-secrets-manager-rotation-lambdas/tree/master/SecretsManagerRDSDb2RotationSingleUser/lambda_function.py
Dependency: python-ibmdb 3.2.8

Amazon RDS Db2 alternating users

Template name: SecretsManagerRDSDb2RotationMultiUser
Rotation strategy: Rotation strategy: alternating users.
SecretString structure: Amazon RDS and Aurora credentials.
Source code: https://github.com/aws-samples/aws-secrets-manager-rotation-lambdas/tree/master/SecretsManagerRDSDb2RotationMultiUser/lambda_function.py
Dependency: python-ibmdb 3.2.8

Amazon RDS MariaDB single user

Template name: SecretsManagerRDSMariaDBRotationSingleUser
Rotation strategy: Rotation strategy: single user.
SecretString structure: Amazon RDS and Aurora credentials.
Source code: https://github.com/aws-samples/aws-secrets-manager-rotation-lambdas/tree/master/SecretsManagerRDSMariaDBRotationSingleUser/lambda_function.py
Dependency: PyMySQL 1.1.1. If you use sha256 password for authentication, PyMySQL[rsa]. For information about using packages with compiled code in a Lambda runtime, see How do I add Python packages with compiled binaries to my deployment package and make the package compatible with Lambda? in AWS Knowledge Center.

Amazon RDS MariaDB alternating users

Template name: SecretsManagerRDSMariaDBRotationMultiUser
Rotation strategy: Rotation strategy: alternating users.
SecretString structure: Amazon RDS and Aurora credentials.
Source code: https://github.com/aws-samples/aws-secrets-manager-rotation-lambdas/tree/master/SecretsManagerRDSMariaDBRotationMultiUser/lambda_function.py
Dependency: PyMySQL 1.1.1. If you use sha256 password for authentication, PyMySQL[rsa]. For information about using packages with compiled code in a Lambda runtime, see How do I add Python packages with compiled binaries to my deployment package and make the package compatible with Lambda? in AWS Knowledge Center.

Amazon RDS and Amazon Aurora MySQL single user

Template name: SecretsManagerRDSMySQLRotationSingleUser
Rotation strategy: Rotation strategy: single user.
Expected SecretString structure: Amazon RDS and Aurora credentials.
Source code: https://github.com/aws-samples/aws-secrets-manager-rotation-lambdas/tree/master/SecretsManagerRDSMySQLRotationSingleUser/lambda_function.py
Dependency: PyMySQL 1.1.1. If you use sha256 password for authentication, PyMySQL[rsa]. For information about using packages with compiled code in a Lambda runtime, see How do I add Python packages with compiled binaries to my deployment package and make the package compatible with Lambda? in AWS Knowledge Center.

Amazon RDS and Amazon Aurora MySQL alternating users

Template name: SecretsManagerRDSMySQLRotationMultiUser
Rotation strategy: Rotation strategy: alternating users.
Expected SecretString structure: Amazon RDS and Aurora credentials.
Source code: https://github.com/aws-samples/aws-secrets-manager-rotation-lambdas/tree/master/SecretsManagerRDSMySQLRotationMultiUser/lambda_function.py
Dependency: PyMySQL 1.1.1. If you use sha256 password for authentication, PyMySQL[rsa]. For information about using packages with compiled code in a Lambda runtime, see How do I add Python packages with compiled binaries to my deployment package and make the package compatible with Lambda? in AWS Knowledge Center.

Amazon RDS Oracle single user

Template name: SecretsManagerRDSOracleRotationSingleUser
Rotation strategy: Rotation strategy: single user.
Expected SecretString structure: Amazon RDS and Aurora credentials.
Source code: https://github.com/aws-samples/aws-secrets-manager-rotation-lambdas/tree/master/SecretsManagerRDSOracleRotationSingleUser/lambda_function.py
Dependency: python-oracledb 2.4.1

Amazon RDS Oracle alternating users

Template name: SecretsManagerRDSOracleRotationMultiUser
Rotation strategy: Rotation strategy: alternating users.
Expected SecretString structure: Amazon RDS and Aurora credentials.
Source code: https://github.com/aws-samples/aws-secrets-manager-rotation-lambdas/tree/master/SecretsManagerRDSOracleRotationMultiUser/lambda_function.py
Dependency: python-oracledb 2.4.1

Amazon RDS and Amazon Aurora PostgreSQL single user

Template name: SecretsManagerRDSPostgreSQLRotationSingleUser
Rotation strategy: Rotation strategy: single user.
Expected SecretString structure: Amazon RDS and Aurora credentials.
Source code: https://github.com/aws-samples/aws-secrets-manager-rotation-lambdas/tree/master/SecretsManagerRDSPostgreSQLRotationSingleUser/lambda_function.py
Dependency: PyGreSQL 6.1.0

Amazon RDS and Amazon Aurora PostgreSQL alternating users

Template name: SecretsManagerRDSPostgreSQLRotationMultiUser
Rotation strategy: Rotation strategy: alternating users.
Expected SecretString structure: Amazon RDS and Aurora credentials.
Source code: https://github.com/aws-samples/aws-secrets-manager-rotation-lambdas/tree/master/SecretsManagerRDSPostgreSQLRotationMultiUser/lambda_function.py
Dependency: PyGreSQL 6.1.0

Amazon RDS Microsoft SQLServer single user

Template name: SecretsManagerRDSSQLServerRotationSingleUser
Rotation strategy: Rotation strategy: single user.
Expected SecretString structure: Amazon RDS and Aurora credentials.
Source code: