MultiUser rotations are incompatible with RDS Proxy

[ahammond]

RDS Proxy consumes a secertsmanager secret to manage access for users. When the multiuser rotation triggers, it changes both the user and password. This causes RDS Proxy to terminate all existing connections. Services which have cached the secret will fail to reconnect since, of course, it has changed.

Since the whole point of a multiuser rotation is to provide a window for services to update their connections, this behaviour is the exact opposite of what was intended.

See also aws/aws-cdk#25568

[ahammond]

By adding

formerUser: string;
formerPassword: string;

to the secret, it exposes the information necessary for people to build workarounds, including the AWS RDS team, should they decide to have RDS Proxies support multi-user rotations.

[adithyasolai]

@ahammond

Thank you for bringing this to our attention.

We are working on appropriately prioritizing development on this issue.

[ahammond]

@adithyasolai already wrote the PR...

[adithyasolai]

@ahammond Yes, we will certainly take your implementation into consideration.

However, there is extra lift in ensuring that every newly-generated Rotation Lambda is updated with this change for all customers.

[ahammond]

Yes but, imagine their joy when multiuser rotations actually work with RDS Proxy. :)

On Fri, May 19, 2023 at 1:32 PM Adithya Solai ***@***.***> wrote: @ahammond <https://github.com/ahammond> Yes, we will certainly take your implementation into consideration. However, there is extra lift in ensuring that every newly-generated Rotation Lambda is updated with this change for all customers. — Reply to this email directly, view it on GitHub <#108 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AADM2RDKHMRD62CCKPB22JTXG7KFLANCNFSM6AAAAAAYH5ENGE> . You are receiving this because you were mentioned.Message ID: <aws-samples/aws-secrets-manager-rotation-lambdas/issues/108/1555205670@ github.com>

-- MiniLockID: uX4VrN5FvyFxFCxgTksGxJqvKa16iBhqseYxxA1UkZVJw GPG: 773A 6BDD 71CE 0AB8 0F5A 1176 8679 A114 FB1A 69BD

[ahammond]

That said, the lack of test coverage for these things is both conspicuous and disturbing. Do you guys have any plans there? Maybe leverage projen like all the cdk stuff has been doing? On Fri, May 19, 2023 at 5:48 PM Andrew Hammond < ***@***.***> wrote:

Yes but, imagine their joy when multiuser rotations actually work with RDS Proxy. :) On Fri, May 19, 2023 at 1:32 PM Adithya Solai ***@***.***> wrote: > @ahammond <https://github.com/ahammond> Yes, we will certainly take your > implementation into consideration. > > However, there is extra lift in ensuring that every newly-generated > Rotation Lambda is updated with this change for all customers. > > — > Reply to this email directly, view it on GitHub > <#108 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AADM2RDKHMRD62CCKPB22JTXG7KFLANCNFSM6AAAAAAYH5ENGE> > . > You are receiving this because you were mentioned.Message ID: > <aws-samples/aws-secrets-manager-rotation-lambdas/issues/108/1555205670@ > github.com> > -- MiniLockID: uX4VrN5FvyFxFCxgTksGxJqvKa16iBhqseYxxA1UkZVJw GPG: 773A 6BDD 71CE 0AB8 0F5A 1176 8679 A114 FB1A 69BD

-- MiniLockID: uX4VrN5FvyFxFCxgTksGxJqvKa16iBhqseYxxA1UkZVJw GPG: 773A 6BDD 71CE 0AB8 0F5A 1176 8679 A114 FB1A 69BD

[jbct]

Hi ahammond. These samples are provided to customers to freely modify to fit their particular use case. This change is not something that we believe should be part of the generic template. I will note that Secrets Manager maintains the history and the previous versions can be retrieved by using the AWSPREVIOUS staging label.

[jbct]

@mrgrain reached out internally about this, and I apologize for misunderstanding the problem and overlooking the CDK related link. Let me follow up with the team on Monday for this and see what we can do to help.

[jbct]

Hi ahammond. I was able to catch up with the RDS Proxy team and unfortunately multiuser rotations are unsupported with RDS Proxy at this time. They will be working on updating public documentation to make the details around this more clear.

The current recommendation from RDS Proxy is to investigate using IAM-based authentication (which wouldn't involve Secrets Manager), or switch to single user rotation.