Question: How do I create a rotation function with an AWS Secrets Manager secret for an unsupported database?

How can I create an AWS Lambda function to rotate AWS Secrets Manager secrets for other databases or third-party services?Short descriptionSecrets Manager secrets created with Amazon Relational Database Service (Amazon RDS) supported databases and other AWS Support services automatically create the Lambda rotation. For unsupported AWS databases and services, you can manually create the Lambda function.

ResolutionUse the generic rotation function template to rotate secrets. Before you turn on rotation for a secret for another database or service, you must create the code for the Lambda rotation function.Important:Before you begin, be sure that you have installed and configured the AWS Command Line Interface (AWS CLI).If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Create an AWS CloudFormation change set based on the generic rotation function templateRun the AWS CLI command create-cloud-formation-change-set for these values:--stack-name: The name of the AWS CloudFormation stack that you create a change set for.--parameter-override: The AWS Secrets Manager Regional endpoints for your Region, and the name of the Lambda rotation function that the template creates.aws serverlessrepo create-cloud-formation-change-set --application-id arn:aws:serverlessrepo:us-east-1:297356227824:applications/SecretsManagerRotationTemplate --stack-name MyLambdaCreationStack --parameter-overrides Name=endpoint,Value=https://secretsmanager.REGION.amazonaws.com Name=functionName,Value=MySecretsManagerRotationFunction --capabilities CAPABILITY_IAM CAPABILITY_RESOURCE_POLICYNote: Make sure to use the Amazon Resource Name (ARN) of arn:aws:serverlessrepo:us-east-1:297356227824:applications/SecretsManagerRotationTemplate exactly as shown.An AWS CloudFormation change set is created for the template. The AWS CloudFormation stack name begins with aws-serverless-repository- and the stack status code is set to REVIEW_IN_PROGRESS.Update a stack using the change setThe create-cloud-formation-change-set command returns the ApplicationId, ChangeSetId, SemanticVersion, and StackId. To update the stack status, you must provide the ChangeSetId to the change-set-name. The change-set-name produces no output and changes the stack status code to CREATE_COMPLETE. The AWS CloudFormation stack creates the Lambda function and an IAM role that's attached to the Lambda function with the required permissions.Run the following AWS CLI command execute-change-set similar to the following:aws cloudformation execute-change-set --change-set-name arn:aws:cloudformation:region:123456789012:changeSet/EXAMPLE1-90ab-cdef-fedc-ba987EXAMPLE/EXAMPLE2-90ab-cdef-fedc-ba987EXAMPLEVerify that the Lambda functions createdRun the following AWS CLI command:aws lambda list-functionsOutput{    ...    "FunctionName": "MySecretsManagerRotationFunction",    ...    "FunctionArn": "arn:aws:lambda:region:123456789012:function:MySecretsManagerRotationFunction",    ... }Note: The name of the Lambda function is the value of function name specified in --parameter-overrides.Configure the Lambda function for Amazon Virtual Private Cloud (Amazon VPC) accessIf your database or service resides in an Amazon VPC, then run the update-function-configuration command similar to the following. The update-function-configuration command configures the Lambda rotation function to run in the VPC. Be sure to provide the VPC subnet IDs and security group IDs. For more information, see Configuring a Lambda function to access resources in an Amazon VPC.Note: If your database or service doesn't reside in an Amazon VPC, then skip this step.$ aws lambda update-function-configuration --function-name your-lambda-function \--vpc-config SubnetIds=subnet-076c28105d486f3bd,subnet-0af00c796ccdc725f,SecurityGroupIds=sg-0aed64f81acc4c037Create a VPC endpoint for the Secrets Manager serviceIf the VPC with your database or service and Lambda rotation function doesn't have internet access, then create a VPC endpoint. Configure the VPC with a private service endpoint to access Secrets Manager and turn on the rotation function at an endpoint within the VPC. Run the create-vpc-endpoint command similar to the following:Note: If your database or service doesn't reside in an Amazon VPC, then skip this step.$ aws ec2 create-vpc-endpoint --vpc-id  vpc-0abb11f5a28a8abe7 --vpc-endpoint-type Interface \--service-name com.amazonaws.your-region.secretsmanager  --subnet-ids subnet-076c28105d486f3bd subnet-0af00c796ccdc725f \--security-group-ids sg-0bacf4bbed67e4df5Set up network connectivity between the Lambda function and database or serviceBe sure that the Lambda function can route to your database or service over the required network ports. This varies depending on the database or service, and its associated VPC configuration.Note: If your database or service does not reside in an Amazon VPC, skip this step.Customize the rotation function for your use caseThe rotation template implements the createSecret and finishSecret steps for you. The setSecret and testSecret steps require manual implementation for your use case and database. For more information, see How rotation works.Turn on rotation for your secretSpecify the number of days between rotations with the parameters --rotation-rules and AutomaticallyAfterDays:aws secretsmanager rotate-secret --secret-id production/MyAwesomeAppSecret --rotation-lambda-arn arn:aws:lambda:region:123456789012:function:MySecretsManagerRotationFunction --rotation-rules AutomaticallyAfterDays=7For more information, see Rotate AWS Secrets Manager secrets.

Related informationAWS Secrets Manager rotation function templatesHow to connect to AWS Secrets Manager service within a Virtual Private Cloud