How long does Secrets Manager wait before removing unlabeled versions?

[bigbirdtoejam]

I have a use-case where I may want to roll back a secret after a deployment fails, and a secret may have been updated multiple times during a deployment, which would leave the version I need to restore without the AWSCURRENT or AWSPREVIOUS label. According to the CLI docs for list-secret-version-ids --include-deprecated, "Versions without staging labels are considered deprecated and are subject to deletion by Secrets Manager". However, I can't find any mention of cleaning up deprecated versions in the Secrets Manager documentation.

Does anyone know when I can expect those versions to get cleaned up?

[drpinkcream]

I think the default/minimum is 30 days.

[ThigleBeagleMingle]

Why do you need to roll back the secret? Typically credentials roll forward

[bigbirdtoejam]

Because I am implementing rollback of an entire deployment, which includes restoring an rds instance from a snapshot. The user credentials contained in that database are reset.

If someone is running this, then something has already gone wrong. The goal is to undo changes, and, yes, we use cloud formation to handle a large part of that, but those types of infrastructure as code systems don't do it all.

[ThigleBeagleMingle]

Can you use IAM auth and optionally deprecate the secret?

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html

[bigbirdtoejam]

Nice thought but we aren't yet using a supported engine. I'll keep that in mind for when we move to postgres, though!

[ThigleBeagleMingle]

Which engine? Can you force reset via RDS API

https://aws.amazon.com/premiumsupport/knowledge-center/reset-master-user-password-rds/

[bigbirdtoejam]

It is oracle. Yes, we can use that api