Requirement Summary:
Secrets managed in AWS Secrets Manager
DB: Amazon RDS for PostgreSQL
Need automated password rotation
Must maintain high availability
Least development effort
Rotation Strategies:
Single-user rotation strategy
Simplest to implement
The secret contains one set of credentials used by app and rotation logic
Supports automated rotation
AWS provides built-in Lambda rotation templates for RDS
A. Alternating-users strategy
⚠️ More complex
Requires application to switch users during rotation window
B. Manual secret + CLI rotation
Too much manual work
Not scalable or reliable
C. Multivalue answer rotation
Not a valid strategy in this context
Doesn’t apply to Secrets Manager
Secrets Manager rotation strategies: https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html
RDS PostgreSQL secret rotation: https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets_strategies.html#rotating-secrets-single-user
Submit