The Lambda Secrets extension caches for 300 seconds by default, so reads right after a rotation can return the stale value. Lower the TTL or request a staging label to pin the version.

Context: Official docs (AWS Lambda with Secrets Manager): the Parameters and Secrets Lambda extension caches secret values for 300 seconds by default. If you rotate a secret and read it right after, you can get the old value for up to five minutes. Lower the cache TTL, or request a specific staging label like AWSCURRENT or AWSPENDING so you know exactly which version you are getting.