Hi, everyone, and welcome back.
Now, in today's video, we are going to discuss about rotating secrets through a secrets manager.
Now, in organizations, whichever tool you use as part of the secrets management, one of the very
important areas is rotation of secrets.
For example, let's say you have one specific secret related to database credentials.
Now, you do not want that secret to be static across years because many users will be joining organization,
many users will be leaving organization and so on.
So as part of the compliance as well as as part of the best practices, it is recommended that you rotate
the secrets regularly.
And this is what we are going to explore in today's video.
So first let's look into the basics of rotation.
Now, rotation is the process of periodically updating a secret.
So if you have a specific password for database, you regularly update the password at a specific time
frame.
It can be seven days, 30 days, six months, etc..
Now, when we discuss about the overall rotation, secret manager makes use of the lambda function to
update the secret as well as the database in case if you're using it.
For example, if you look into this specific diagram, you have a lambda function and you have a secret
manager.
Now lambda function can go ahead and rotate the secret based on the schedule that you define as part
of the secret manager.
So let's go ahead and quickly look into it.
Now for today's video.
I have two secrets that are available.
One of the secret is called Prod App.
Now, if you look into this specific secret, there is a rotation configuration.
At this stage, the rotation is disabled.
That means the secret will not be updated.
So you can go ahead and edit the rotation.
So in case if you enable the rotation here, you can specify that secret should be rotated at what duration.
So your hours, days, weeks, months.
You can also write the cron expiration for overall management.
And the next important part is the rotation function, which is the lambda function which will go ahead
and rotate the overall secret.
Now, in a similar way, one of the secret here is created automatically and managed by radius.
So this is created by ideas.
Now, if you look into this specific secret at this stage, you have a username here and you have a
password here and you have a rotation configuration enabled with the rotation schedule is seven days.
So after seven days this secret will be rotated automatically.
Now, one of the important things, in fact, we were discussing here, and this might also have created
confusion where it states that secret manager rotation uses Lambda function to update the secret and
the database.
So what exactly this database mean?
Because we know that the lambda function can update the secret.
However, in cases where the secret is created by idea, so whenever you create an ideas and ideas,
Intern is creating this specific secret associated with its credentials.
So after seven days, the Lambda function that is associated what it will do, it will update the secret
here, which is the username password, primarily the password, and it will also update the database
instance with a new password.
Because if you just update the secret here and you do not update the database, then the database will
still accept the older password.
And this is the reason why the lambda function should be able to update both the secret and the database.
And this is what it referred to in the second point.
Now, let's also look into some of the points that needs to be noted.
First one is that to rotate a secret, as we have already seen, the secret manager calls a lambda function
according to the schedule that you set up.
And based on the invocation, the lambda will rotate.
The secret.
Second important pointer is that the secret manager provides the rotation function templates for various
use cases related to ideas, document DB, Redshift and others as part of the rotation here.
Let's also quickly look into it now within the secret that was managed by R.D., as we were discussing
on how Lambda function can not only update the secret here, but it can also connect to the Ides instance
and update the password there.
So for this you need some kind of a logic that needs to be introduced and this is where the function
templates comes into picture.
So as part of the overall rotation, Secret manager has certain function templates for the rotation
document, DB Redshift, elastic cache, as well as other secrets.
For example, if you look into the ideas over here, let's explore the My SQL single user template.
So you have the source code.
Let's open up the source code.
So this is the entire source code that you can make use of.
You do not really have to create one by yourself.
However, if you are creating ideas with secrets manager integrated, all of these things are taken
care of.
In case if you have other type of secrets, let's explore that.
So in such cases there is a template which can act as a starting point here, which can help you.
If you look into the source code here, this is the entire source code.
Again, this is quite useful as well.
Again, these are all templates that you will see are associated with the Lambda function grid.
So this is the high level overview about rotating secrets and secrets Manager and with this will conclude
today's video.