Why did my Lambda rotation function fail when it called a second function to rotate a Secrets Manager secret?

Resolution

If a rotation function calls a second Lambda function to rotate the secret, the rotation fails with a message similar to the following:

"Pending secret version EXAMPLE1-90ab-cdef-fedc-ba987EXAMPLE for Secret MySecret was not created by Lambda MyRotationFunction. Remove the AWSPENDING staging label and restart rotation."

To resolve this issue, make sure that the code to rotate your secret is contained in a single Lambda function that's set as the rotation function for the secret.

If your Lambda rotation function code failed, see Why did my Secrets Manager Lambda rotation fail?

Related information

Troubleshoot AWS Secrets Manager rotation

AWS Secrets Manager rotation function templates

Rotation by Lambda function