RDS credentials in Secrets Manager rotate every 30 days. The grants API caches the secret in memory and must keep serving traffic when rotation occurs. What should the application implement?
Select an answer to reveal the explanation.
Short Explanation
Rotation day should feel like a pit stop, not a tow truck. When the old password stops working, grab the fresh secret and retry — no citywide outage required.
Full Explanation
Applications that cache secrets must handle rotation by refreshing from Secrets Manager and retrying on authentication failure (or by using dual-password windows during rotation). Disabling rotation, relying only on scheduled fleet restarts, or publishing passwords publicly defeat the security and availability goals of managed rotation.