# Check the database endpoint inside a replicated Secrets Manager secret

> A secret replica can be local to a Region while still naming the original database endpoint.

- Canonical URL: https://update.dsesecurity.com/updates/aws-secrets-manager-replica-database-connection-endpoint/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:14:14+00:00
- Modified: 2026-10-20T18:34:30+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

A secret replica can be local to a Region while still naming the original database endpoint.

## Potentially affected

This concerns Secrets Manager regional replication. It does not create or fail over a database, rewrite application routing or guarantee that the credentials work against every regional database.

## DSE recommendation

DSE recommends documenting the intended relationship among the secret Region, application Region and actual database endpoint.

## Article

A secret replica can be local to a Region while still naming the original database endpoint.

## Source facts

Secrets Manager replicates encrypted secret data and metadata across selected Regions. AWS warns that a replicated database secret contains the same source-database connection information as the original; replication does not substitute a local database endpoint. Additional key-value pairs can hold regional connection information. When rotation is enabled on the primary secret, updated values propagate to its associated replicas.

Source: [AWS — Replicate AWS Secrets Manager secrets across Regions](https://docs.aws.amazon.com/secretsmanager/latest/userguide/replicate-secrets.html).

## Applicability

This concerns Secrets Manager regional replication. It does not create or fail over a database, rewrite application routing or guarantee that the credentials work against every regional database.

## DSE recommendation

DSE recommends documenting the intended relationship among the secret Region, application Region and actual database endpoint. Review connection fields during disaster-recovery planning instead of treating a local secret lookup as evidence of local data access. Define who manages regional connection metadata and how applications choose it. Include replica state and primary rotation ownership in the credential handoff. Include the connection destination as an explicit recovery acceptance item for each consuming application. Ask the database and application owners to approve the same regional mapping, with a separate decision for credential propagation and for the endpoint the application will actually use.

## Verification

Proposed verification: from an authorized test application in each intended Region, inspect nonsecret connection metadata and verify the actual database destination. Test authentication against the approved endpoint after a controlled rotation. Confirm the recovery runbook distinguishes reading a replica from switching the application to a recovered database.

## Official reference

[AWS — Replicate AWS Secrets Manager secrets across Regions](https://docs.aws.amazon.com/secretsmanager/latest/userguide/replicate-secrets.html). Reviewed October 20, 2026.

## Primary reference

- Name: AWS — Replicate AWS Secrets Manager secrets across Regions
- Authority: docs.aws.amazon.com
- URL: https://docs.aws.amazon.com/secretsmanager/latest/userguide/replicate-secrets.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check the database endpoint inside a replicated Secrets Manager secret,” DSE Security, https://update.dsesecurity.com/updates/aws-secrets-manager-replica-database-connection-endpoint/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.