Check the database endpoint inside a replicated Secrets Manager secret

A secret replica can be local to a Region while still naming the original database endpoint.

Source facts

Secrets Manager replicates encrypted secret data and metadata across selected Regions. AWS warns that a replicated database secret contains the same source-database connection information as the original; replication does not substitute a local database endpoint. Additional key-value pairs can hold regional connection information. When rotation is enabled on the primary secret, updated values propagate to its associated replicas.

Source: AWS — Replicate AWS Secrets Manager secrets across Regions.

Applicability

This concerns Secrets Manager regional replication. It does not create or fail over a database, rewrite application routing or guarantee that the credentials work against every regional database.

DSE recommendation

DSE recommends documenting the intended relationship among the secret Region, application Region and actual database endpoint. Review connection fields during disaster-recovery planning instead of treating a local secret lookup as evidence of local data access. Define who manages regional connection metadata and how applications choose it. Include replica state and primary rotation ownership in the credential handoff. Include the connection destination as an explicit recovery acceptance item for each consuming application. Ask the database and application owners to approve the same regional mapping, with a separate decision for credential propagation and for the endpoint the application will actually use.

Verification

Proposed verification: from an authorized test application in each intended Region, inspect nonsecret connection metadata and verify the actual database destination. Test authentication against the approved endpoint after a controlled rotation. Confirm the recovery runbook distinguishes reading a replica from switching the application to a recovered database.

Official reference

AWS — Replicate AWS Secrets Manager secrets across Regions. Reviewed October 20, 2026.