{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/aws-secrets-manager-replica-database-connection-endpoint/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/aws-secrets-manager-replica-database-connection-endpoint/",
        "slug": "aws-secrets-manager-replica-database-connection-endpoint",
        "url": "https://update.dsesecurity.com/updates/aws-secrets-manager-replica-database-connection-endpoint/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/aws-secrets-manager-replica-database-connection-endpoint.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/aws-secrets-manager-replica-database-connection-endpoint/"
        },
        "title": "Check the database endpoint inside a replicated Secrets Manager secret",
        "summary": "A secret replica can be local to a Region while still naming the original database endpoint.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "managed-it",
            "label": "Managed IT operations",
            "alt": "A controlled technology lifecycle progressing from assessment to approved production.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "business-continuity",
                "name": "Business Continuity",
                "url": "https://update.dsesecurity.com/topic/business-continuity/"
            },
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:14:14+00:00",
        "modified_at": "2026-10-20T18:34:30+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 275,
        "potentially_affected": "This concerns Secrets Manager regional replication. It does not create or fail over a database, rewrite application routing or guarantee that the credentials work against every regional database.",
        "dse_recommendation": "DSE recommends documenting the intended relationship among the secret Region, application Region and actual database endpoint.",
        "primary_source": {
            "name": "AWS — Replicate AWS Secrets Manager secrets across Regions",
            "url": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/replicate-secrets.html",
            "published_on": null,
            "authority": "docs.aws.amazon.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>A secret replica can be local to a Region while still naming the original database endpoint.</p>\n<h2>Source facts</h2>\n<p>Secrets Manager replicates encrypted secret data and metadata across selected Regions. AWS warns that a replicated database secret contains the same source-database connection information as the original; replication does not substitute a local database endpoint. Additional key-value pairs can hold regional connection information. When rotation is enabled on the primary secret, updated values propagate to its associated replicas.</p>\n<p>Source: <a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/replicate-secrets.html\">AWS — Replicate AWS Secrets Manager secrets across Regions</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns Secrets Manager regional replication. It does not create or fail over a database, rewrite application routing or guarantee that the credentials work against every regional database.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends documenting the intended relationship among the secret Region, application Region and actual database endpoint. Review connection fields during disaster-recovery planning instead of treating a local secret lookup as evidence of local data access. Define who manages regional connection metadata and how applications choose it. Include replica state and primary rotation ownership in the credential handoff. Include the connection destination as an explicit recovery acceptance item for each consuming application. Ask the database and application owners to approve the same regional mapping, with a separate decision for credential propagation and for the endpoint the application will actually use.</p>\n<h2>Verification</h2>\n<p>Proposed verification: from an authorized test application in each intended Region, inspect nonsecret connection metadata and verify the actual database destination. Test authentication against the approved endpoint after a controlled rotation. Confirm the recovery runbook distinguishes reading a replica from switching the application to a recovered database.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/replicate-secrets.html\">AWS — Replicate AWS Secrets Manager secrets across Regions</a>. Reviewed October 20, 2026.</p>",
        "content_text": "A secret replica can be local to a Region while still naming the original database endpoint.\nSource facts\nSecrets Manager replicates encrypted secret data and metadata across selected Regions. AWS warns that a replicated database secret contains the same source-database connection information as the original; replication does not substitute a local database endpoint. Additional key-value pairs can hold regional connection information. When rotation is enabled on the primary secret, updated values propagate to its associated replicas.\nSource: AWS — Replicate AWS Secrets Manager secrets across Regions.\nApplicability\nThis concerns Secrets Manager regional replication. It does not create or fail over a database, rewrite application routing or guarantee that the credentials work against every regional database.\nDSE recommendation\nDSE recommends documenting the intended relationship among the secret Region, application Region and actual database endpoint. Review connection fields during disaster-recovery planning instead of treating a local secret lookup as evidence of local data access. Define who manages regional connection metadata and how applications choose it. Include replica state and primary rotation ownership in the credential handoff. Include the connection destination as an explicit recovery acceptance item for each consuming application. Ask the database and application owners to approve the same regional mapping, with a separate decision for credential propagation and for the endpoint the application will actually use.\nVerification\nProposed verification: from an authorized test application in each intended Region, inspect nonsecret connection metadata and verify the actual database destination. Test authentication against the approved endpoint after a controlled rotation. Confirm the recovery runbook distinguishes reading a replica from switching the application to a recovered database.\nOfficial reference\nAWS — Replicate AWS Secrets Manager secrets across Regions. Reviewed October 20, 2026.",
        "content_markdown": "A secret replica can be local to a Region while still naming the original database endpoint.\n\n## Source facts\n\nSecrets Manager replicates encrypted secret data and metadata across selected Regions. AWS warns that a replicated database secret contains the same source-database connection information as the original; replication does not substitute a local database endpoint. Additional key-value pairs can hold regional connection information. When rotation is enabled on the primary secret, updated values propagate to its associated replicas.\n\nSource: [AWS — Replicate AWS Secrets Manager secrets across Regions](https://docs.aws.amazon.com/secretsmanager/latest/userguide/replicate-secrets.html).\n\n## Applicability\n\nThis concerns Secrets Manager regional replication. It does not create or fail over a database, rewrite application routing or guarantee that the credentials work against every regional database.\n\n## DSE recommendation\n\nDSE recommends documenting the intended relationship among the secret Region, application Region and actual database endpoint. Review connection fields during disaster-recovery planning instead of treating a local secret lookup as evidence of local data access. Define who manages regional connection metadata and how applications choose it. Include replica state and primary rotation ownership in the credential handoff. Include the connection destination as an explicit recovery acceptance item for each consuming application. Ask the database and application owners to approve the same regional mapping, with a separate decision for credential propagation and for the endpoint the application will actually use.\n\n## Verification\n\nProposed verification: from an authorized test application in each intended Region, inspect nonsecret connection metadata and verify the actual database destination. Test authentication against the approved endpoint after a controlled rotation. Confirm the recovery runbook distinguishes reading a replica from switching the application to a recovered database.\n\n## Official reference\n\n[AWS — Replicate AWS Secrets Manager secrets across Regions](https://docs.aws.amazon.com/secretsmanager/latest/userguide/replicate-secrets.html). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-replica-database-connection-endpoint/",
                "url": "https://update.dsesecurity.com/updates/aws-secrets-manager-replica-database-connection-endpoint/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-replica-database-connection-endpoint/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Business Continuity",
                        "item": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Check the database endpoint inside a replicated Secrets Manager secret",
                        "item": "https://update.dsesecurity.com/updates/aws-secrets-manager-replica-database-connection-endpoint/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-replica-database-connection-endpoint/#article",
                "identifier": "https://update.dsesecurity.com/updates/aws-secrets-manager-replica-database-connection-endpoint/",
                "url": "https://update.dsesecurity.com/updates/aws-secrets-manager-replica-database-connection-endpoint/",
                "headline": "Check the database endpoint inside a replicated Secrets Manager secret",
                "description": "A secret replica can be local to a Region while still naming the original database endpoint.",
                "abstract": "A secret replica can be local to a Region while still naming the original database endpoint.",
                "articleBody": "A secret replica can be local to a Region while still naming the original database endpoint.\nSource facts\nSecrets Manager replicates encrypted secret data and metadata across selected Regions. AWS warns that a replicated database secret contains the same source-database connection information as the original; replication does not substitute a local database endpoint. Additional key-value pairs can hold regional connection information. When rotation is enabled on the primary secret, updated values propagate to its associated replicas.\nSource: AWS — Replicate AWS Secrets Manager secrets across Regions.\nApplicability\nThis concerns Secrets Manager regional replication. It does not create or fail over a database, rewrite application routing or guarantee that the credentials work against every regional database.\nDSE recommendation\nDSE recommends documenting the intended relationship among the secret Region, application Region and actual database endpoint. Review connection fields during disaster-recovery planning instead of treating a local secret lookup as evidence of local data access. Define who manages regional connection metadata and how applications choose it. Include replica state and primary rotation ownership in the credential handoff. Include the connection destination as an explicit recovery acceptance item for each consuming application. Ask the database and application owners to approve the same regional mapping, with a separate decision for credential propagation and for the endpoint the application will actually use.\nVerification\nProposed verification: from an authorized test application in each intended Region, inspect nonsecret connection metadata and verify the actual database destination. Test authentication against the approved endpoint after a controlled rotation. Confirm the recovery runbook distinguishes reading a replica from switching the application to a recovered database.\nOfficial reference\nAWS — Replicate AWS Secrets Manager secrets across Regions. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:14:14+00:00",
                "dateModified": "2026-10-20T18:34:30+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-replica-database-connection-endpoint/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-replica-database-connection-endpoint/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Check the database endpoint inside a replicated Secrets Manager secret"
                },
                "articleSection": [
                    "Business Continuity",
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Business Continuity",
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Business Continuity",
                        "url": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 275,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "AWS — Replicate AWS Secrets Manager secrets across Regions",
                    "url": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/replicate-secrets.html"
                }
            }
        ]
    }
}