My Lambda rotation function called a second function to rotate a Secrets Manager secret but it failed. Why did the second Lambda function fail?

Short description

If a rotation function calls a second Lambda function to rotate the secret, the rotation fails with a message similar to the following:

Pending secret version EXAMPLE1-90ab-cdef-fedc-ba987EXAMPLE for Secret MySecret was not created by Lambda MyRotationFunction. Remove the AWSPENDING staging label and restart rotation.

Resolution

To resolve this issue, make sure that the code to rotate your secret is contained in a single Lambda function that's set as the rotation function for the secret.

Related information

Troubleshoot AWS Secrets Manager rotation