Set Up a Secrets Manager Rotation Lambda

When secret rotation is enabled, Secrets Manager calls a Lambda function to generate and store a new secret value. AWS provides pre-built rotation Lambdas for RDS (PostgreSQL, MySQL, MariaDB), Redshift, and DocumentDB via the Serverless Application Repository. You deploy the Lambda first, then paste its ARN into the rotationLambdaArn field.

Paste into this field

Secrets Manager → rotationLambdaArn

Output looks like

arn:aws:lambda:us-east-1:123456789012:function:SecretsManagerRDSPostgreSQLRotation

1Use AWS Serverless Application Repository (fastest)

Navigate to the Serverless Application Repository in the AWS Console. Search for "SecretsManager". AWS publishes official rotation Lambdas:

• SecretsManagerRDSPostgreSQLRotationSingleUser — PostgreSQL single-user rotation

• SecretsManagerRDSMySQLRotationSingleUser — MySQL/MariaDB single-user rotation

• SecretsManagerRedshiftRotationSingleUser — Redshift rotation

6Deploy the rotation Lambda

Click the function → "Deploy". Fill in parameters (VPC, subnet IDs if database is in a VPC). Click "Deploy".

8Grant the Lambda permission to access your secret

In Secrets Manager → your secret → "Rotation" tab → click "Edit rotation". Select the Lambda you just deployed. AWS automatically adds the resource-based policy to allow Secrets Manager to invoke it.

10Copy the Lambda ARN

In Lambda → Functions → click the rotation function → copy the "Function ARN" at the top right.

12Paste into CloudStack Canvas

Select your Secrets Manager node → paste the ARN into "rotationLambdaArn".

Once you have the value, go back to CloudStack Canvas and paste it into the highlighted field.

CloudStack Canvas · Validation Guide