# Keep permissions aligned for alternating Secrets Manager database users

> Alternating credentials introduce a second database user whose permissions need an explicit maintenance owner.

- Canonical URL: https://update.dsesecurity.com/updates/aws-secrets-manager-alternating-user-permission-drift/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:14:15+00:00
- Modified: 2026-10-20T18:34:30+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Alternating credentials introduce a second database user whose permissions need an explicit maintenance owner.

## Potentially affected

This concerns documented Lambda database-rotation strategies. It does not establish that a particular database permission model is suitable, or that every application avoids authentication failures during rotation.

## DSE recommendation

DSE recommends reviewing the database’s ownership and permission model before selecting alternating users.

## Article

Alternating credentials introduce a second database user whose permissions need an explicit maintenance owner.

## Source facts

For Lambda-based database rotation, Secrets Manager supports single-user and alternating-user strategies. The alternating strategy creates a clone and switches which user’s password is updated. It needs privileged credentials in a separate secret. AWS states that later permission changes to the original user must also be made to the clone. AWS recommends single-user rotation where cloned users do not have equivalent permissions.

Source: [AWS — Lambda function rotation strategies](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotation-strategy.html).

## Applicability

This concerns documented Lambda database-rotation strategies. It does not establish that a particular database permission model is suitable, or that every application avoids authentication failures during rotation.

## DSE recommendation

DSE recommends reviewing the database’s ownership and permission model before selecting alternating users. Put both user identities in the access review and link permission changes to both when that strategy is used. Identify the owner of the privileged rotation secret and keep application permissions separate from rotation permissions. Plan retry and recovery behavior with the application owner rather than assuming the rotation strategy eliminates every interruption. Keep the clone identity in the database permission-change checklist after the first rotation. Require the owner to explain how a later grant or revocation will be applied and verified for both users before selecting this strategy for a long-lived application.

## Verification

Proposed verification: in a permitted test database, inspect both users’ effective privileges and run representative allowed and denied operations after rotation. Apply an approved permission change and confirm the intended alignment. Retain identity names and outcomes, with no passwords or secret values in the evidence record.

## Official reference

[AWS — Lambda function rotation strategies](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotation-strategy.html). Reviewed October 20, 2026.

## Primary reference

- Name: AWS — Lambda function rotation strategies
- Authority: docs.aws.amazon.com
- URL: https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotation-strategy.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Keep permissions aligned for alternating Secrets Manager database users,” DSE Security, https://update.dsesecurity.com/updates/aws-secrets-manager-alternating-user-permission-drift/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.