The city’s parking-citation database password was written into Vault as a new version, but the database has not been cut over yet. Apps that always fetch the current secret must keep using the old password until cutover. Which rotation-state pairing is correct?

Rotation states separate staged credentials from live ones. For the parking-citation database, the new password version should be marked pending while the database still expects the old bytes. Apps that always fetch the current secret continue to receive the prior current version until cutover. After the database is updated to accept the new password, operators promote the pending version to current so those apps flip only when the target system is ready. That pending-then-current sequence prevents a mid-rotation window where Functions present a password the database rejects.

Marking the new version current immediately and parking the old version as pending inverts the model: apps that fetch current would see the new password before the database cutover and fail authentication. Deleting the old version and leaving the new version without a rotation state ignores that Functions and other clients that request current rely on rotation state; without a deliberate current marker, cutover timing is uncontrolled and rollback harder. Setting both versions to current so API Gateway would load-balance passwords is not how Vault rotation works—there is not a dual-current load-balance path for secret versions through the gateway.

Exam caveat: clients that pin a specific version number bypass current/pending semantics, so document whether civic apps fetch current or a fixed version before designing the rotation runbook. Operational check: before promoting pending to current, confirm the citation database accepts the new password with a controlled test login, then promote and immediately re-fetch current from a sample Function to ensure the version number advanced as expected.