Secret rotation

Replacing a password, key, or token and moving every consumer to the new one before the old credential is revoked.

change passwords without taking the app downreplace API keys on a scheduleswap credentials while both still workold key new key overlapautomatic password rolloverwe have to change our keys every 90 dayssecert rotationexpire and replace service keys

What it is

Secret rotation replaces a password, API key, certificate, or token with a new one, moves every consumer over, and then revokes the old one. A zero-downtime rotation includes an overlap period where both credentials work, or uses a broker that updates the secret and its target together. AWS Secrets Manager, for example, tracks versions with stages such as `AWSCURRENT` and `AWSPENDING`.

Reach for it before credentials expire, whenever policy requires a maximum credential age, and immediately after suspected exposure or an operator leaves. Automating the routine path proves that rotation works before an emergency makes the same procedure urgent.

Gotcha: changing the stored value is only half the job. Long-lived processes may cache the old credential, replicas may reload at different times, and a hard-coded copy may hide in CI. Observe which version each consumer uses, wait for the old version to go quiet, then revoke it.

Ask AI for it

Implement zero-downtime database credential rotation with AWS Secrets Manager. Use a Lambda rotation function with the createSecret, setSecret, testSecret, and finishSecret steps and the AWSPENDING and AWSCURRENT version stages. Schedule rotation every 30 days, make the application reload the secret without a restart, and keep the previous credential valid during a bounded overlap. Add a test that opens a new database connection with AWSPENDING before promotion, metrics showing which version is in use, an alarm when any instance still uses the old version after the grace period, and a documented emergency rotation procedure.

You might have meant

secrets managementapi keyenvironment variableszero downtime deploy