Identify Secrets Manager versions by staging labels rather than a presumed history order

A secret’s current value is selected through a staging label, not by assuming every stored version forms an archive.

Source facts

Secrets Manager creates a new version when a secret value changes or rotates. AWS labels the current, previous and pending versions AWSCURRENT, AWSPREVIOUS and AWSPENDING. A normal value retrieval returns AWSCURRENT by default. Staging labels cannot be shared by two versions. Labeled versions are retained, while unlabeled versions are deprecated and can be removed under the documented cleanup rules.

Source: AWS — What’s in a Secrets Manager secret?.

Applicability

This concerns Secrets Manager value versions and labels. A secret version is not an independent database account state, and moving a label does not by itself establish credential validity in the target service.

DSE recommendation

DSE recommends recording the version identifier and label mapping during rotation investigations without recording plaintext credentials. Decide which consumers intentionally request a specific version and which use the current label. Keep any proposed label change linked to verification of the underlying service credential. Do not rely on unlabeled versions as the organization’s permanent history or recovery archive. Define who may approve a staging-label move during an incident and how the receiving application will be checked. Keep the version metadata separate from the usable value, and document any deliberate retained label instead of relying on unlabelled versions as an informal archive.

Verification

Proposed verification: use a permitted test secret to inspect version identifiers and staging labels before and after a controlled update. Confirm the value-retrieval path selects the intended version through a harmless test comparison. Check application authentication separately, and retain only metadata and test outcomes in the operational record.

Official reference

AWS — What’s in a Secrets Manager secret?. Reviewed October 20, 2026.