{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/aws-secrets-manager-version-staging-label-current-previous/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/aws-secrets-manager-version-staging-label-current-previous/",
        "slug": "aws-secrets-manager-version-staging-label-current-previous",
        "url": "https://update.dsesecurity.com/updates/aws-secrets-manager-version-staging-label-current-previous/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/aws-secrets-manager-version-staging-label-current-previous.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/aws-secrets-manager-version-staging-label-current-previous/"
        },
        "title": "Identify Secrets Manager versions by staging labels rather than a presumed history order",
        "summary": "A secret’s current value is selected through a staging label, not by assuming every stored version forms an archive.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "managed-it",
            "label": "Managed IT operations",
            "alt": "A controlled technology lifecycle progressing from assessment to approved production.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "business-continuity",
                "name": "Business Continuity",
                "url": "https://update.dsesecurity.com/topic/business-continuity/"
            },
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:14:13+00:00",
        "modified_at": "2026-10-20T18:34:30+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 286,
        "potentially_affected": "This concerns Secrets Manager value versions and labels. A secret version is not an independent database account state, and moving a label does not by itself establish credential validity in the target service.",
        "dse_recommendation": "DSE recommends recording the version identifier and label mapping during rotation investigations without recording plaintext credentials.",
        "primary_source": {
            "name": "AWS — What's in a Secrets Manager secret?",
            "url": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/whats-in-a-secret.html",
            "published_on": null,
            "authority": "docs.aws.amazon.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>A secret’s current value is selected through a staging label, not by assuming every stored version forms an archive.</p>\n<h2>Source facts</h2>\n<p>Secrets Manager creates a new version when a secret value changes or rotates. AWS labels the current, previous and pending versions AWSCURRENT, AWSPREVIOUS and AWSPENDING. A normal value retrieval returns AWSCURRENT by default. Staging labels cannot be shared by two versions. Labeled versions are retained, while unlabeled versions are deprecated and can be removed under the documented cleanup rules.</p>\n<p>Source: <a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/whats-in-a-secret.html\">AWS — What&#8217;s in a Secrets Manager secret?</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns Secrets Manager value versions and labels. A secret version is not an independent database account state, and moving a label does not by itself establish credential validity in the target service.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends recording the version identifier and label mapping during rotation investigations without recording plaintext credentials. Decide which consumers intentionally request a specific version and which use the current label. Keep any proposed label change linked to verification of the underlying service credential. Do not rely on unlabeled versions as the organization’s permanent history or recovery archive. Define who may approve a staging-label move during an incident and how the receiving application will be checked. Keep the version metadata separate from the usable value, and document any deliberate retained label instead of relying on unlabelled versions as an informal archive.</p>\n<h2>Verification</h2>\n<p>Proposed verification: use a permitted test secret to inspect version identifiers and staging labels before and after a controlled update. Confirm the value-retrieval path selects the intended version through a harmless test comparison. Check application authentication separately, and retain only metadata and test outcomes in the operational record.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/whats-in-a-secret.html\">AWS — What&#8217;s in a Secrets Manager secret?</a>. Reviewed October 20, 2026.</p>",
        "content_text": "A secret’s current value is selected through a staging label, not by assuming every stored version forms an archive.\nSource facts\nSecrets Manager creates a new version when a secret value changes or rotates. AWS labels the current, previous and pending versions AWSCURRENT, AWSPREVIOUS and AWSPENDING. A normal value retrieval returns AWSCURRENT by default. Staging labels cannot be shared by two versions. Labeled versions are retained, while unlabeled versions are deprecated and can be removed under the documented cleanup rules.\nSource: AWS — What’s in a Secrets Manager secret?.\nApplicability\nThis concerns Secrets Manager value versions and labels. A secret version is not an independent database account state, and moving a label does not by itself establish credential validity in the target service.\nDSE recommendation\nDSE recommends recording the version identifier and label mapping during rotation investigations without recording plaintext credentials. Decide which consumers intentionally request a specific version and which use the current label. Keep any proposed label change linked to verification of the underlying service credential. Do not rely on unlabeled versions as the organization’s permanent history or recovery archive. Define who may approve a staging-label move during an incident and how the receiving application will be checked. Keep the version metadata separate from the usable value, and document any deliberate retained label instead of relying on unlabelled versions as an informal archive.\nVerification\nProposed verification: use a permitted test secret to inspect version identifiers and staging labels before and after a controlled update. Confirm the value-retrieval path selects the intended version through a harmless test comparison. Check application authentication separately, and retain only metadata and test outcomes in the operational record.\nOfficial reference\nAWS — What’s in a Secrets Manager secret?. Reviewed October 20, 2026.",
        "content_markdown": "A secret’s current value is selected through a staging label, not by assuming every stored version forms an archive.\n\n## Source facts\n\nSecrets Manager creates a new version when a secret value changes or rotates. AWS labels the current, previous and pending versions AWSCURRENT, AWSPREVIOUS and AWSPENDING. A normal value retrieval returns AWSCURRENT by default. Staging labels cannot be shared by two versions. Labeled versions are retained, while unlabeled versions are deprecated and can be removed under the documented cleanup rules.\n\nSource: [AWS — What’s in a Secrets Manager secret?](https://docs.aws.amazon.com/secretsmanager/latest/userguide/whats-in-a-secret.html).\n\n## Applicability\n\nThis concerns Secrets Manager value versions and labels. A secret version is not an independent database account state, and moving a label does not by itself establish credential validity in the target service.\n\n## DSE recommendation\n\nDSE recommends recording the version identifier and label mapping during rotation investigations without recording plaintext credentials. Decide which consumers intentionally request a specific version and which use the current label. Keep any proposed label change linked to verification of the underlying service credential. Do not rely on unlabeled versions as the organization’s permanent history or recovery archive. Define who may approve a staging-label move during an incident and how the receiving application will be checked. Keep the version metadata separate from the usable value, and document any deliberate retained label instead of relying on unlabelled versions as an informal archive.\n\n## Verification\n\nProposed verification: use a permitted test secret to inspect version identifiers and staging labels before and after a controlled update. Confirm the value-retrieval path selects the intended version through a harmless test comparison. Check application authentication separately, and retain only metadata and test outcomes in the operational record.\n\n## Official reference\n\n[AWS — What’s in a Secrets Manager secret?](https://docs.aws.amazon.com/secretsmanager/latest/userguide/whats-in-a-secret.html). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-version-staging-label-current-previous/",
                "url": "https://update.dsesecurity.com/updates/aws-secrets-manager-version-staging-label-current-previous/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-version-staging-label-current-previous/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Business Continuity",
                        "item": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Identify Secrets Manager versions by staging labels rather than a presumed history order",
                        "item": "https://update.dsesecurity.com/updates/aws-secrets-manager-version-staging-label-current-previous/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-version-staging-label-current-previous/#article",
                "identifier": "https://update.dsesecurity.com/updates/aws-secrets-manager-version-staging-label-current-previous/",
                "url": "https://update.dsesecurity.com/updates/aws-secrets-manager-version-staging-label-current-previous/",
                "headline": "Identify Secrets Manager versions by staging labels rather than a presumed history order",
                "description": "A secret’s current value is selected through a staging label, not by assuming every stored version forms an archive.",
                "abstract": "A secret’s current value is selected through a staging label, not by assuming every stored version forms an archive.",
                "articleBody": "A secret’s current value is selected through a staging label, not by assuming every stored version forms an archive.\nSource facts\nSecrets Manager creates a new version when a secret value changes or rotates. AWS labels the current, previous and pending versions AWSCURRENT, AWSPREVIOUS and AWSPENDING. A normal value retrieval returns AWSCURRENT by default. Staging labels cannot be shared by two versions. Labeled versions are retained, while unlabeled versions are deprecated and can be removed under the documented cleanup rules.\nSource: AWS — What’s in a Secrets Manager secret?.\nApplicability\nThis concerns Secrets Manager value versions and labels. A secret version is not an independent database account state, and moving a label does not by itself establish credential validity in the target service.\nDSE recommendation\nDSE recommends recording the version identifier and label mapping during rotation investigations without recording plaintext credentials. Decide which consumers intentionally request a specific version and which use the current label. Keep any proposed label change linked to verification of the underlying service credential. Do not rely on unlabeled versions as the organization’s permanent history or recovery archive. Define who may approve a staging-label move during an incident and how the receiving application will be checked. Keep the version metadata separate from the usable value, and document any deliberate retained label instead of relying on unlabelled versions as an informal archive.\nVerification\nProposed verification: use a permitted test secret to inspect version identifiers and staging labels before and after a controlled update. Confirm the value-retrieval path selects the intended version through a harmless test comparison. Check application authentication separately, and retain only metadata and test outcomes in the operational record.\nOfficial reference\nAWS — What’s in a Secrets Manager secret?. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:14:13+00:00",
                "dateModified": "2026-10-20T18:34:30+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-version-staging-label-current-previous/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-version-staging-label-current-previous/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Identify Secrets Manager versions by staging labels rather than a presumed history order"
                },
                "articleSection": [
                    "Business Continuity",
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Business Continuity",
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Business Continuity",
                        "url": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 286,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "AWS — What's in a Secrets Manager secret?",
                    "url": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/whats-in-a-secret.html"
                }
            }
        ]
    }
}