Secret rotation
Replacing a password, key, or token and moving every consumer to the new one before the old credential is revoked.
What it is
Secret rotation replaces a password, API key, certificate, or token with a new one, moves every consumer over, and then revokes the old one. A zero-downtime rotation includes an overlap period where both credentials work, or uses a broker that updates the secret and its target together. AWS Secrets Manager, for example, tracks versions with stages such as `AWSCURRENT` and `AWSPENDING`.
Reach for it before credentials expire, whenever policy requires a maximum credential age, and immediately after suspected exposure or an operator leaves. Automating the routine path proves that rotation works before an emergency makes the same procedure urgent.
Gotcha: changing the stored value is only half the job. Long-lived processes may cache the old credential, replicas may reload at different times, and a hard-coded copy may hide in CI. Observe which version each consumer uses, wait for the old version to go quiet, then revoke it.
Ask AI for it
Implement zero-downtime database credential rotation with AWS Secrets Manager. Use a Lambda rotation function with the createSecret, setSecret, testSecret, and finishSecret steps and the AWSPENDING and AWSCURRENT version stages. Schedule rotation every 30 days, make the application reload the secret without a restart, and keep the previous credential valid during a bounded overlap. Add a test that opens a new database connection with AWSPENDING before promotion, metrics showing which version is in use, an alarm when any instance still uses the old version after the grace period, and a documented emergency rotation procedure.