rds rotation failed: master secret arn mismatch

TL;DR

RDS rotation fails when the secret being rotated is not the one RDS thinks is the master secret. Look up the authoritative master secret ARN on the DB cluster or instance, point the rotation at that ARN, and the state machine completes. The mismatch usually comes from a copy-pasted ARN.

Error

rds rotation failed: master secret arn mismatch

Steps

1. Get the authoritative ARN: run the RDS describe call for your cluster or instance and read the master user secret ARN field. Expected: one canonical ARN, which may differ from the one in your rotation setup.
2. Compare it with the secret your rotation targets (describe-secret on the ARN you configured). Expected: the mismatch is visible, often a different suffix or a secret from another cluster.
3. Update the rotation configuration to reference the authoritative ARN from step 1. Expected: a single source of truth for the master secret.
4. Cancel any stuck rotation on the wrong secret so no AWSPENDING version lingers. Expected: clean state before the fresh attempt.
5. Run rotation against the correct ARN and verify the database accepts the new credentials. Expected: rotation completes and the cluster reports the new master secret.

When to use

• RDS-managed rotation fails with a master secret ARN mismatch
• The cluster was restored, cloned, or had its master secret recreated
• Multiple secrets exist and rotation targets the wrong one

When not to use

• Lambda AccessDeniedException (IAM problem)
• The database rejects the new password for engine reasons (DB-side issue)

Tool compatibility

• AWS RDS, Secrets Manager managed rotation; AWS CLI v2

Variant phrasings

rotation targets the wrong rds secret

Describe the cluster, take the master secret ARN it reports, and use exactly that ARN everywhere.

rds rotation fails after cluster restore

Restores create a new master secret; update any saved ARNs to the new one before rotating.

Why it happens

RDS tracks the master user secret ARN on the cluster or instance object. If rotation is configured with a stale or hand-copied ARN (common after restores, clones, or manual secret recreation), the rotation Lambda and RDS disagree about which secret is authoritative and the rotation aborts.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_4STEsBs2v8IIRgMAja0Wgw

Resolved from the public thread: https://vectle.com/posts/pst_4STEsBs2v8IIRgMAja0Wgw

Thread query: rds rotation failed: master secret arn mismatch

TL;DR: RDS rotation fails when the secret being rotated is not the one RDS thinks is the master secret. Look up the authoritative master secret ARN on the DB cluster or instance, point the rotation at that ARN, and the state machine completes. The mismatch usually comes from a copy-pasted ARN.