You might have security or compliance standards that prevent a database user from changing their own credentials and from having multiple users with identical permissions. AWS Secrets Manager offers two rotation strategies for secrets that contain Amazon Relational Database Service (Amazon RDS) credentials: single-user and alternating-user.

   <p>In the preceding scenario, neither single-user rotation nor alternating-user rotation would meet your security or compliance standards. Single-user rotation uses database user credentials in the secret to rotate itself (assuming the user has change-password permissions). Alternating-user rotation uses Amazon RDS admin credentials from another secret to create and update a <code>_clone</code> user credential, which means there are two valid user credentials with identical permissions.</p> 
   <p>In this post, you will learn how to implement a modified alternating-user solution that uses Amazon RDS admin user credentials to rotate database credentials while not creating an identical <code>_clone</code> user. This modified rotation strategy creates a short lag between when the password in the database changes and when the secret is updated. During this brief lag before the new password is updated, database calls using the old credentials might be denied. Test this in your environment to determine if the lag is within an acceptable range.</p> 
   <h2>Walkthrough</h2> 
   <p>In this walkthrough, you will learn how to implement the modified rotation strategy by modifying the existing alternating-user rotation template. To accomplish this, you need to complete the following:</p> 
   <ul> 
    <li>Configure alternating-user rotation on the database credential secret for which you want to implement the modified rotation strategy.</li> 
    <li>Modify your <a href="https://aws.amazon.com/lambda/" target="_blank" rel="noopener">AWS Lambda</a> rotation function template code to implement the modified rotation strategy.</li> 
    <li>Test the modified rotation strategy on your database credential secret and verify that the secret was rotated while also not creating a <code>_clone</code> user.</li> 
   </ul> 
   <h3>To configure alternating-user rotation on the database credential secret</h3> 
   <ol> 
    <li>Follow this AWS Security Blog post to <a href="https://aws.amazon.com/blogs/security/improve-security-of-amazon-rds-master-database-credentials-using-secrets-manager/" target="_blank" rel="noopener">set up alternating-user rotation on an Amazon RDS instance</a>.</li> 
    <li>When configuring rotation for the database user secret in the Secrets Manager console, clear the checkbox for <strong>Rotate immediately when the secret is stored. The next rotation will begin on your schedule</strong> in the <strong>Rotation schedule</strong> tab. Make sure that no <code>_clone</code> user is created by the default alternating-user rotation code through your database’s user tables.</li> 
   </ol> 

   <div id="attachment_34325" class="wp-caption aligncenter"> 
    <a href="https://infracom.com.sg/wp-content/uploads/2024/05/img1.jpg"><img aria-describedby="caption-attachment-34325" src="https://infracom.com.sg/wp-content/uploads/2024/05/img1.jpg" alt="Figure 1: Clear the checkbox for Rotate immediately when the secret is stored" width="780" class="size-full wp-image-34325"></a> 
    <p id="caption-attachment-34325" class="wp-caption-text">Figure 1: Clear the checkbox for <strong>Rotate immediately when the secret is stored</strong></p> 
   </div> 

   <h3>To modify your Lambda function rotation Lambda template to implement the modified rotation strategy</h3> 
   <ol> 
    <li>In the Secrets Manager console, select the <strong>Secrets</strong> menu from the left pane. Then, select the new database user secret’s name from the <strong>Secret name</strong> column.  
     <div id="attachment_34326" class="wp-caption aligncenter"> 
      <a href="https://infracom.com.sg/wp-content/uploads/2024/05/img2.jpg"><img aria-describedby="caption-attachment-34326" loading="lazy" src="https://infracom.com.sg/wp-content/uploads/2024/05/img2.jpg" alt="Figure 2: Select the new database user secret" width="1535" height="319" class="size-full wp-image-34326"></a> 
      <p id="caption-attachment-34326" class="wp-caption-text">Figure 2: Select the new database user secret</p> 
     </div> </li> 
    <li>Select the <strong>Rotation</strong> tab on the Secrets page, and then choose the link under <strong>Lambda rotation function</strong>.  
     <div id="attachment_34327" class="wp-caption aligncenter"> 
      <a href="https://infracom.com.sg/wp-content/uploads/2024/05/img3.jpg"><img aria-describedby="caption-attachment-34327" src="https://infracom.com.sg/wp-content/uploads/2024/05/img3.jpg" alt="Figure 3: Select the Lambda rotation function" width="740" class="size-full wp-image-34327"></a> 
      <p id="caption-attachment-34327" class="wp-caption-text">Figure 3: Select the Lambda rotation function</p> 
     </div> </li> 
    <li>From the rotation Lambda menu, <strong>Download</strong> select <strong>Download function code.zip</strong>.  
     <div id="attachment_34328" class="wp-caption aligncenter"> 
      <a href="https://infracom.com.sg/wp-content/uploads/2024/05/img4.jpg"><img aria-describedby="caption-attachment-34328" src="https://infracom.com.sg/wp-content/uploads/2024/05/img4.jpg" alt="Figure 4: Select Download function code .zip from Download" width="740" class="size-full wp-image-34328"></a> 
      <p id="caption-attachment-34328" class="wp-caption-text">Figure 4: Select <strong>Download function code .zip</strong> from <strong>Download</strong></p> 
     </div>  </li> 
    <li>Unzip the .zip file. Open the <span>lambda_function.py</span> file in a code editor and make the following code changes to implement the modified rotation strategy. <p>The following code changes show how to modify a rotation function for the <a href="https://github.com/aws-samples/aws-secrets-manager-rotation-lambdas/blob/master/SecretsManagerRDSMySQLRotationMultiUser/lambda_function.py" target="_blank" rel="noopener">MySQL alternating-user rotation code template</a>. You must make similar changes in the <code>CreateSecret</code> and <code>SetSecret</code> steps of the alternating-user rotation code template for your database’s engine type.</p> <p>To make the needed changes, remove the lines of code that are in <em>grey italic</em> and add the lines of code that are <strong>bold</strong>.</p> <p>Consider using <a href="https://docs.aws.amazon.com/lambda/latest/dg/configuration-versions.html" target="_blank" rel="noopener">AWS Lambda function versions</a> to enable reverting your Lambda function to previous iterations in case this modified rotation strategy goes wrong.</p> <h4>In create_secret()</h4> <p>The following code suggestion removes the creation of <code>_clone-suffixed</code> usernames.</p> <p>Remove:</p> 
     <div class="hide-language"> 
      <pre class="unlimited-height-code"><code class="lang-text">-- # Get the alternate username swapping between the original user and the user with _clone appended to it

— current_dict[‘username’] = get_alt_username(current_dict[‘username’])

In set_secret()

The following code suggestions remove the creation of _clone-suffixed usernames and subsequent checks for such usernames in conditional logic.

Keep:

     <div class="hide-language"> 
      <pre class="unlimited-height-code"><code class="lang-text"># Get username character limit from environment variable

username_limit = int(os.environ.get(‘USERNAME_CHARACTER_LIMIT’, ’16’))