Secrets rotation
Verify that the old credential is actually revoked
Publishing a new value does not necessarily remove the old authority. Review the target's credential and session behaviour before declaring rotation complete.
In this article
Distinguish storage from validity
A secret manager can hold several versions while the target service decides which values it accepts. Changing a current-version reference does not by itself prove that an older credential fails.
Identify the target-side action that replaces or revokes the previous value under the selected strategy.
Test through an approved safe path without exposing the value in logs. Record the result and the relevant version identity.
Check existing sessions separately
Some targets allow already authenticated sessions to continue after a credential change. New connections may fail with the old value while established ones remain usable.
Decide whether that behaviour meets the routine rotation objective. For urgent compromise response, additional session invalidation or access restriction may be required under the incident plan.
Do not assume a password change and termination of all authority are identical operations.
Review overlap and rollback
If both credentials remain valid during transition, define the maximum intended overlap and the evidence required before retirement. Include delayed consumers and scheduled jobs.
A rollback procedure should explain when returning to the previous value is acceptable. A suspected compromised value should not become the default availability fallback.
Check failure after each stage so the team knows which credential is valid when automation stops partway through.
Confirm the final consumer state
Verify representative new connections and the required business operation from every consumer class. Check that the replacement has the intended permissions.
Remove temporary diagnostic access and obsolete copies according to policy. Keep the rotation record focused on identifiers, outcomes and unresolved gaps.
Approve completion only when the target validity, consumer adoption and retirement policy are all demonstrated. A successful update call proves one action, not the end of the credential's lifecycle.
Primary sources
AWS Secrets Manager: rotation strategiesReferences checked 11 September 2026.