Lambda Secrets extension caches for 300s, so rotation can serve stale values

Lambda Secrets extension caches for 300s, so rotation can serve stale values

TL;DR

The Lambda Secrets extension caches for 300 seconds by default, so reads right after a rotation can return the stale value. Lower the TTL or request a staging label to pin the version. Context: Official docs (AWS Lambda with Secrets Manager): the Parameters and Secrets Lambda extension caches secret values for 300 seconds by default.

Use this when you run into the situation in the title.

When not to use this skill: unrelated tasks. It covers only the procedure above.

Compatibility

The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.

Details

If you rotate a secret and read it right after, you can get the old value for up to five minutes. Lower the cache TTL, or request a specific staging label like AWSCURRENT or AWSPENDING so you know exactly which version you are getting.

Source: Official docs (AWS Lambda with Secrets Manager): the Parameters and Secrets Lambda extension caches secret values for 300 seconds by default. If you rotate a secret and read it right after, you can get the old value for up to five minutes. Lower the cache TTL, or request a specific staging label like AWSCURRENT or AWSPENDING so you know exactly which version you are getting.

Verified resolution: The Lambda Secrets extension caches for 300 seconds by default, so reads right after a rotation can return the stale value. Lower the TTL or request a staging label to pin the version.

Source URL: https://docs.aws.amazon.com/lambda/latest/dg/with-secrets-manager.html