Rotating secrets credential of a different account
I have two AWS account A and B. In the account A there's an RDS database that use PostgreSQL. In the account B there are some credentials stored in Secret Manager. I would like to have a rotation function in account B that rotate the credentials stored in account B, and connecting to the database change the DB credential that are in an RDS of the account A.
Is this possible? I found this application in the serverless repo and it seems it could be used, but the last two parameters are related with subnets and security groups.
How should I handle this in cross account rotation? PS: Have in mind that the VPC that contains the database (account A) and the VPC that contains the rotation function (account B) are peered.
- Newest
- Most votes
- Most comments
Yes. You could set up something like this:
- Create a role in Account A with permissions to update the secrets in Account A
- create a role in account B for a lambda function to use. This role should have access to read the secret in account B, the basic lambda IAM requirements and assume-role to the role in account A
- update the trust policy on the role created in step 1 so it allows the role in step 2 to assume the role
- in account B, set up an EventBridge rule which triggers when the secret is rotated (start here)
- set up a target for this eventbridge rule to trigger a lambda function in Account B using the role created in step 2.
- the code in this lambda function should read the secrets from Account B (local account) and then assume the role in account A using STS AssumeRole. With this assumed role, you can call the Update Secret API and maintain the same values in account A as B is using
for the AssumeRole setup, this article may help
