Secrets Manager for RDS db readonly instance

Question

When creating a new RDS secret using Secrets Manager the AWS Console gives the list of RDS db instances. I don't see our readonly instance as part of that list. Do I need to create a custom secret instead of RDS secret to store readonly instance credentials?

Giovanni Lauria · Answer

When creating a new RDS secret in AWS Secrets Manager, it usually lists the RDS DB instances for storing credentials. However, read replicas might not be listed due to certain limitations. If your read-only instance is a read replica, this could be why it’s not appearing. In this case, you might need to create a custom secret to store the credentials for your read-only instance. Remember to follow best practices for managing secrets.

Govardhanan_R · Answer

Hi Shivinder,

You are essentially right in that you need to create custom secrets to work with read-only RDS instances. Also, while the secrets created for read-write RDS instances are used for many functions including creating backups, read replicas, and other administrative tasks, the secrets for read-only RDS instances are used only for connecting to the database instance and performing read-only queries.

See under **Limitations** section in https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-secrets-manager.html

Hope this helps,

Regards,

Govardhanan.

Secrets Manager for RDS db readonly instance

Relevant content