# Identify Secrets Manager versions by staging labels rather than a presumed history order

> A secret’s current value is selected through a staging label, not by assuming every stored version forms an archive.

- Canonical URL: https://update.dsesecurity.com/updates/aws-secrets-manager-version-staging-label-current-previous/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:14:13+00:00
- Modified: 2026-10-20T18:34:30+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

A secret’s current value is selected through a staging label, not by assuming every stored version forms an archive.

## Potentially affected

This concerns Secrets Manager value versions and labels. A secret version is not an independent database account state, and moving a label does not by itself establish credential validity in the target service.

## DSE recommendation

DSE recommends recording the version identifier and label mapping during rotation investigations without recording plaintext credentials.

## Article

A secret’s current value is selected through a staging label, not by assuming every stored version forms an archive.

## Source facts

Secrets Manager creates a new version when a secret value changes or rotates. AWS labels the current, previous and pending versions AWSCURRENT, AWSPREVIOUS and AWSPENDING. A normal value retrieval returns AWSCURRENT by default. Staging labels cannot be shared by two versions. Labeled versions are retained, while unlabeled versions are deprecated and can be removed under the documented cleanup rules.

Source: [AWS — What’s in a Secrets Manager secret?](https://docs.aws.amazon.com/secretsmanager/latest/userguide/whats-in-a-secret.html).

## Applicability

This concerns Secrets Manager value versions and labels. A secret version is not an independent database account state, and moving a label does not by itself establish credential validity in the target service.

## DSE recommendation

DSE recommends recording the version identifier and label mapping during rotation investigations without recording plaintext credentials. Decide which consumers intentionally request a specific version and which use the current label. Keep any proposed label change linked to verification of the underlying service credential. Do not rely on unlabeled versions as the organization’s permanent history or recovery archive. Define who may approve a staging-label move during an incident and how the receiving application will be checked. Keep the version metadata separate from the usable value, and document any deliberate retained label instead of relying on unlabelled versions as an informal archive.

## Verification

Proposed verification: use a permitted test secret to inspect version identifiers and staging labels before and after a controlled update. Confirm the value-retrieval path selects the intended version through a harmless test comparison. Check application authentication separately, and retain only metadata and test outcomes in the operational record.

## Official reference

[AWS — What’s in a Secrets Manager secret?](https://docs.aws.amazon.com/secretsmanager/latest/userguide/whats-in-a-secret.html). Reviewed October 20, 2026.

## Primary reference

- Name: AWS — What's in a Secrets Manager secret?
- Authority: docs.aws.amazon.com
- URL: https://docs.aws.amazon.com/secretsmanager/latest/userguide/whats-in-a-secret.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Identify Secrets Manager versions by staging labels rather than a presumed history order,” DSE Security, https://update.dsesecurity.com/updates/aws-secrets-manager-version-staging-label-current-previous/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.