This document guides you on how to configure and manage rotation policies for database secrets in SSM. Database secrets support automatic rotation. SSM automatically updates the database account password according to the configured schedule and synchronizes it to the secret. Applications can then obtain the latest password via the SDK, eliminating the need for manual intervention.
Database secret rotation currently supports:
Relational databases: MySQL secrets, TDSQL_C_MySQL secrets, PostgreSQL secrets, SQL Server secrets;
Enterprise distributed databases: TDSQL_MySQL secrets.
Attention:
Risk Warning: Do not cache the account passwords from secrets in your business code or any third-party SDKs (which have built-in connection pools). Otherwise, database connection failures may occur. It is recommended to refer to Database Credentials Application to proactively mitigate these risks. Enabling Automatic Rotation
For database secrets whose rotation was not enabled during creation, you can manually enable it on the secret details page:
1. Log in to the SSM console, and click Database Credential in the left sidebar. 2. On the Database Secrets list page, select the region where your secrets are located in the upper-left corner.
3. On the Secrets list page, click the target Secret name.
4. In the Rotation Information area, click Configure rotation.
5. In the pop-up window, configure the following items:
|
Rotation status | Select Enable to activate automatic rotation. After you disable rotation, the secret password will no longer be updated automatically. After you enable rotation, SSM will periodically update the passwords for database accounts. |
Rotation cycle | The interval for automatic rotation. Rule: This field is required. It is recommended to select a value between 30-365 days based on security and compliance requirements. |
Next rotation Start | The next scheduled rotation time. Subsequent rotations will be triggered periodically according to the rotation cycle. Rule: This field is required. It is recommended to select an off-peak business hour (for example, 2:00 AM) to avoid impacting your business. |
6. Click OK. The rotation configuration takes effect immediately.
Note:
During rotation, SSM sends a password modification request to the database instance. Ensure that the database instance is in a normal state and network connectivity is available. Otherwise, the rotation will fail.
The application must dynamically obtain secret content via the SDK and avoid caching passwords locally. Otherwise, connection failures may occur after rotation.
Modifying the Rotation Policy
1. In the Rotation Information area on the Credential Details page, click Configure Rotation.
2. Modify the rotation period and start time as needed.
3. Click OK to save. The modified rotation period takes effect starting from the next rotation.
Manually Triggering Rotation
If you need to update the password immediately before the scheduled rotation period, you can manually trigger a rotation:
1. In the Rotation Information area on the Credential Details page, click Rotate Now.
2. In the confirmation dialog box that appears, confirm the operation and then click OK.
3. SSM immediately sends a password modification request to the database instance. After the password is updated, SSM synchronizes the new password to the current version of the credential.
Note:
Manual rotation does not disrupt the existing automatic rotation schedule. For example, if the rotation period is set to 30 days and you perform a manual rotation 10 days after the last automatic rotation, the next automatic rotation still executes as originally scheduled when the 30-day period expires.
After credential rotation is completed, the password in the database is automatically updated to a new random value. For applications that have integrated the SSM SDK, the latest database password is automatically obtained the next time they access the database, enabling seamless password switching. If you need to manually log in to the database using the current account, view and obtain the latest password on the Credential Details page.
Disabling Automatic Rotation
1. In the Rotation Information area on the Credential Details page, click Configure Rotation.
2. Switch the rotation status to disabled, and then click OK.
3. After you disable it, SSM no longer automatically updates the password, and the current credential content remains unchanged. You can re-enable automatic rotation at any time.
Viewing Rotation History
In the Version Information area on the Credential Details page, you can view the rotation version information and the currently active account password.
Attention:
The plaintext password is automatically obtained and updated by applications through the SSM API. For security reasons, it is generally not recommended that you view the value of a managed credential in the console.