[question] initial credential rotation about cdk-iam-credentials-rotator

[willdady]

Hi @robertd. You can trigger this manually by simply invoking the Lambda function which is normally triggered by the EventBridge rule. Refer to the architecture diagram at the bottom of the README.

[robertd]

@willdady I've tried triggering the function with EventBridge trigger (description: Initiates IAM credential rotation for a list of users)... but I keep getting the error in the screenshot.

However, I noticed if I play around with scheduleDuration I can trigger key rotation, but that requires multiple cdk deployments (setting this param to some arbitrary value in the future initially, and then setting it yo 7 days which will trigger key rotation and custom handler execution).

[willdady]

Deleting the credentials from Secrets Manager is not instant.

Secrets Manager performs the actual deletion with an asynchronous background process, so there might be a short delay before the secret is permanently deleted.

You are likely to run into this error if you set scheduleDuration too low as it will be trying to create the secret when it already exists, albeit in a deleting state. Similarly, if you manually invoke the Lambda more than once within a small amount of time you are very likely get that error.

Unfortunately it's unclear on how long it typically takes for the secret to actually be deleted.

[robertd]

Thanks for all the help. 👍