RDS Poxy Bug Please Fix

Hi,

You are not the first one to report this: see https://repost.aws/questions/QU5YCuPSPDQoKhQLJXNAxOJQ/why-so-many-secret-manager-api-requests for same problem and some form of explations

It seems that RDS proxy refreshes secrets approx. every 30s even if no sql requests are made.

Best,

Didier

What RDS Proxy actually does with Secrets

• When you use standard IAM authentication with RDS Proxy, your application authenticates to the proxy using IAM, and the proxy authenticates to the database using credentials stored in Secrets Manager. The proxy retrieves those credentials from Secrets Manager “on your behalf.”

• If you switch the proxy to end-to-end IAM authentication, your apps authenticate with IAM through the proxy and the proxy no longer needs Secrets Manager database-user credentials (you don’t have to register DB users via Secrets); this eliminates Secrets-based credential management for the DB side.

See - RDS Proxy security : https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy.howitworks.html#rds-proxy-security

Why Secrets calls can be higher than Lambda invokes

• RDS Proxy runs independently from your DB instance and maintains its own connection pool. Your app can open many client connections to the proxy while the proxy keeps a (separate) set of connections to the DB. The pool is serverless and auto-scales based on workload and connection behavior. Because of that indirection, counts like “Lambda invocations” aren’t 1:1 with the proxy’s backend actions (including credential retrieval to connect/refresh backend DB connections).

• The proxy also does multiplexing (reusing DB connections across transactions) and borrowing connections from the pool; it may keep or recycle connections based on transaction state or pin a session if it can’t safely reuse the connection. These connection-lifecycle choices are proxy-managed, not driven by your Lambda invoke count.

Knobs you can tune (connection behavior)

• Review your IdleClientTimeout and other connection settings. For example, IdleClientTimeout controls how long a client connection to the proxy can sit idle before the proxy closes it (default 30 minutes). Adjusting this and related limits (MaxConnectionsPercent, MaxIdleConnectionsPercent, ConnectionBorrowTimeout) changes how aggressively the proxy opens/closes client and backend connections—which indirectly affects how often it needs DB credentials.

See - RDS Proxy connection considerations : https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy-connections.html

What to try next

1. Check which auth mode your proxy uses.

   • If you’re on standard IAM authentication, the proxy does pull DB credentials from Secrets Manager. That’s expected per design.
   • If you want to avoid Secrets-driven DB credentials entirely, consider end-to-end IAM authentication (no Secrets Manager DB users registered with the proxy).

2. Right-size proxy connection settings.

   • Tune IdleClientTimeout (and related settings) so the proxy isn’t churning connections more than necessary for your workload profile.

3. Remember the lifecycle separation.

   • The proxy’s backend connection pool isn’t tied to your Lambda invoke count; it scales and reuses connections based on transactions, pinning, and pooling rules documented for RDS Proxy. Higher Secrets activity alone doesn’t prove a proxy bug.

---

Bottom line: According to the RDS Proxy docs, it’s expected for the proxy to retrieve DB credentials from Secrets Manager when configured with standard IAM auth, and its independent connection pooling means those retrieves won’t line up with your Lambda invoke count. If minimizing Secrets Manager calls is a goal, the end-to-end IAM authentication mode (no Secrets-stored DB creds) is the doc-supported way to avoid them, and you can also tune connection settings to reduce connection churn.

---

If any part of this explanation was helpful in resolving your issue, feel free to let me know — happy to help further.