{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/aws-secrets-manager-alternating-user-permission-drift/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/aws-secrets-manager-alternating-user-permission-drift/",
        "slug": "aws-secrets-manager-alternating-user-permission-drift",
        "url": "https://update.dsesecurity.com/updates/aws-secrets-manager-alternating-user-permission-drift/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/aws-secrets-manager-alternating-user-permission-drift.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/aws-secrets-manager-alternating-user-permission-drift/"
        },
        "title": "Keep permissions aligned for alternating Secrets Manager database users",
        "summary": "Alternating credentials introduce a second database user whose permissions need an explicit maintenance owner.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "continuity-recovery",
            "label": "Continuity & recovery",
            "alt": "Paired infrastructure paths converging on a stable recovered service.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "business-continuity",
                "name": "Business Continuity",
                "url": "https://update.dsesecurity.com/topic/business-continuity/"
            },
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:14:15+00:00",
        "modified_at": "2026-10-20T18:34:30+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 277,
        "potentially_affected": "This concerns documented Lambda database-rotation strategies. It does not establish that a particular database permission model is suitable, or that every application avoids authentication failures during rotation.",
        "dse_recommendation": "DSE recommends reviewing the database’s ownership and permission model before selecting alternating users.",
        "primary_source": {
            "name": "AWS — Lambda function rotation strategies",
            "url": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotation-strategy.html",
            "published_on": null,
            "authority": "docs.aws.amazon.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Alternating credentials introduce a second database user whose permissions need an explicit maintenance owner.</p>\n<h2>Source facts</h2>\n<p>For Lambda-based database rotation, Secrets Manager supports single-user and alternating-user strategies. The alternating strategy creates a clone and switches which user’s password is updated. It needs privileged credentials in a separate secret. AWS states that later permission changes to the original user must also be made to the clone. AWS recommends single-user rotation where cloned users do not have equivalent permissions.</p>\n<p>Source: <a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotation-strategy.html\">AWS — Lambda function rotation strategies</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns documented Lambda database-rotation strategies. It does not establish that a particular database permission model is suitable, or that every application avoids authentication failures during rotation.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends reviewing the database’s ownership and permission model before selecting alternating users. Put both user identities in the access review and link permission changes to both when that strategy is used. Identify the owner of the privileged rotation secret and keep application permissions separate from rotation permissions. Plan retry and recovery behavior with the application owner rather than assuming the rotation strategy eliminates every interruption. Keep the clone identity in the database permission-change checklist after the first rotation. Require the owner to explain how a later grant or revocation will be applied and verified for both users before selecting this strategy for a long-lived application.</p>\n<h2>Verification</h2>\n<p>Proposed verification: in a permitted test database, inspect both users’ effective privileges and run representative allowed and denied operations after rotation. Apply an approved permission change and confirm the intended alignment. Retain identity names and outcomes, with no passwords or secret values in the evidence record.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotation-strategy.html\">AWS — Lambda function rotation strategies</a>. Reviewed October 20, 2026.</p>",
        "content_text": "Alternating credentials introduce a second database user whose permissions need an explicit maintenance owner.\nSource facts\nFor Lambda-based database rotation, Secrets Manager supports single-user and alternating-user strategies. The alternating strategy creates a clone and switches which user’s password is updated. It needs privileged credentials in a separate secret. AWS states that later permission changes to the original user must also be made to the clone. AWS recommends single-user rotation where cloned users do not have equivalent permissions.\nSource: AWS — Lambda function rotation strategies.\nApplicability\nThis concerns documented Lambda database-rotation strategies. It does not establish that a particular database permission model is suitable, or that every application avoids authentication failures during rotation.\nDSE recommendation\nDSE recommends reviewing the database’s ownership and permission model before selecting alternating users. Put both user identities in the access review and link permission changes to both when that strategy is used. Identify the owner of the privileged rotation secret and keep application permissions separate from rotation permissions. Plan retry and recovery behavior with the application owner rather than assuming the rotation strategy eliminates every interruption. Keep the clone identity in the database permission-change checklist after the first rotation. Require the owner to explain how a later grant or revocation will be applied and verified for both users before selecting this strategy for a long-lived application.\nVerification\nProposed verification: in a permitted test database, inspect both users’ effective privileges and run representative allowed and denied operations after rotation. Apply an approved permission change and confirm the intended alignment. Retain identity names and outcomes, with no passwords or secret values in the evidence record.\nOfficial reference\nAWS — Lambda function rotation strategies. Reviewed October 20, 2026.",
        "content_markdown": "Alternating credentials introduce a second database user whose permissions need an explicit maintenance owner.\n\n## Source facts\n\nFor Lambda-based database rotation, Secrets Manager supports single-user and alternating-user strategies. The alternating strategy creates a clone and switches which user’s password is updated. It needs privileged credentials in a separate secret. AWS states that later permission changes to the original user must also be made to the clone. AWS recommends single-user rotation where cloned users do not have equivalent permissions.\n\nSource: [AWS — Lambda function rotation strategies](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotation-strategy.html).\n\n## Applicability\n\nThis concerns documented Lambda database-rotation strategies. It does not establish that a particular database permission model is suitable, or that every application avoids authentication failures during rotation.\n\n## DSE recommendation\n\nDSE recommends reviewing the database’s ownership and permission model before selecting alternating users. Put both user identities in the access review and link permission changes to both when that strategy is used. Identify the owner of the privileged rotation secret and keep application permissions separate from rotation permissions. Plan retry and recovery behavior with the application owner rather than assuming the rotation strategy eliminates every interruption. Keep the clone identity in the database permission-change checklist after the first rotation. Require the owner to explain how a later grant or revocation will be applied and verified for both users before selecting this strategy for a long-lived application.\n\n## Verification\n\nProposed verification: in a permitted test database, inspect both users’ effective privileges and run representative allowed and denied operations after rotation. Apply an approved permission change and confirm the intended alignment. Retain identity names and outcomes, with no passwords or secret values in the evidence record.\n\n## Official reference\n\n[AWS — Lambda function rotation strategies](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotation-strategy.html). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-alternating-user-permission-drift/",
                "url": "https://update.dsesecurity.com/updates/aws-secrets-manager-alternating-user-permission-drift/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-alternating-user-permission-drift/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Business Continuity",
                        "item": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Keep permissions aligned for alternating Secrets Manager database users",
                        "item": "https://update.dsesecurity.com/updates/aws-secrets-manager-alternating-user-permission-drift/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-alternating-user-permission-drift/#article",
                "identifier": "https://update.dsesecurity.com/updates/aws-secrets-manager-alternating-user-permission-drift/",
                "url": "https://update.dsesecurity.com/updates/aws-secrets-manager-alternating-user-permission-drift/",
                "headline": "Keep permissions aligned for alternating Secrets Manager database users",
                "description": "Alternating credentials introduce a second database user whose permissions need an explicit maintenance owner.",
                "abstract": "Alternating credentials introduce a second database user whose permissions need an explicit maintenance owner.",
                "articleBody": "Alternating credentials introduce a second database user whose permissions need an explicit maintenance owner.\nSource facts\nFor Lambda-based database rotation, Secrets Manager supports single-user and alternating-user strategies. The alternating strategy creates a clone and switches which user’s password is updated. It needs privileged credentials in a separate secret. AWS states that later permission changes to the original user must also be made to the clone. AWS recommends single-user rotation where cloned users do not have equivalent permissions.\nSource: AWS — Lambda function rotation strategies.\nApplicability\nThis concerns documented Lambda database-rotation strategies. It does not establish that a particular database permission model is suitable, or that every application avoids authentication failures during rotation.\nDSE recommendation\nDSE recommends reviewing the database’s ownership and permission model before selecting alternating users. Put both user identities in the access review and link permission changes to both when that strategy is used. Identify the owner of the privileged rotation secret and keep application permissions separate from rotation permissions. Plan retry and recovery behavior with the application owner rather than assuming the rotation strategy eliminates every interruption. Keep the clone identity in the database permission-change checklist after the first rotation. Require the owner to explain how a later grant or revocation will be applied and verified for both users before selecting this strategy for a long-lived application.\nVerification\nProposed verification: in a permitted test database, inspect both users’ effective privileges and run representative allowed and denied operations after rotation. Apply an approved permission change and confirm the intended alignment. Retain identity names and outcomes, with no passwords or secret values in the evidence record.\nOfficial reference\nAWS — Lambda function rotation strategies. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:14:15+00:00",
                "dateModified": "2026-10-20T18:34:30+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-alternating-user-permission-drift/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-alternating-user-permission-drift/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Keep permissions aligned for alternating Secrets Manager database users"
                },
                "articleSection": [
                    "Business Continuity",
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Business Continuity",
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Business Continuity",
                        "url": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 277,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "AWS — Lambda function rotation strategies",
                    "url": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotation-strategy.html"
                }
            }
        ]
    }
}