Read replica of RDS with Secrets Manager integration

You are correct that creating a read replica is generally not supported when the source DB or DB cluster manages credentials with AWS Secrets Manager, with the exception of RDS for SQL Server. This limitation exists because of the complexities involved in synchronizing credentials between the primary instance and read replicas.

However, there are a few approaches you can consider to work around this limitation:

1. For RDS for SQL Server: You can create read replicas as normal, since this is the one exception to the limitation.

2. For other DB engines: You'll need to manage the credentials manually or use a custom solution. Here's an approach you could consider:

• Create the read replica without using Secrets Manager integration for credential management.
• Manually create a custom secret in Secrets Manager for the read replica.
• Implement a custom rotation solution using AWS Lambda. This Lambda function would be responsible for rotating passwords on both the primary instance and the read replica, and updating the corresponding secrets in Secrets Manager.

3. Alternatively, you could consider not using Secrets Manager integration for the primary instance. Instead, manage credentials manually for both the primary and read replica instances using custom secrets in Secrets Manager. This would allow you to create read replicas as normal, but you'd lose the automatic integration benefits for the primary instance.

It's important to note that these workarounds require more manual setup and maintenance compared to the native Secrets Manager integration. You'll need to carefully manage the credential rotation process to ensure that the primary and replica instances remain in sync.

Remember to follow best practices for managing secrets and ensure that your custom solutions maintain the security standards required for your database credentials.
Sources
Password management with Amazon RDS and AWS Secrets Manager - Amazon Relational Database Service
How to sync the password of existing logins between Primary and Read Replica instance for RDS for SQL Server | AWS re:Post
Automate Amazon RDS credential rotation with AWS Secrets Manager for primary instances with read replicas | AWS Database Blog

You're right — AWS doesn't currently support creating read replicas when the primary RDS instance uses built-in Secrets Manager integration (except for SQL Server). This is mostly because the automated credential rotation can't be synchronized cleanly across replicas.

If read replicas are essential for your setup, you have two main options:

Detach from Secrets Manager integration and manage credentials manually — that’ll unblock replica creation.

Use a custom Lambda-based rotation solution where both the primary and the replica pull credentials from manually maintained secrets.

It’s more work, but it gives you control until AWS adds broader support. Just be sure to document and test your rotation logic thoroughly if you go the custom route.