AWS secretsmanager documentation change
Summary
Updated documentation to transition Lambda rotation functions from Python 3.7/3.9 to Python 3.12, removed old upgrade paths, added new upgrade procedures, and updated example ARNs with placeholders.
Security assessment
The changes are routine documentation updates for upgrading Python runtime versions in Lambda rotation functions. There is no mention of security vulnerabilities, patches, or incidents. The update is related to AWS SDK support policy changes and maintaining compatibility with supported Python versions, which is a standard maintenance activity. No security implications are directly addressed or introduced by these changes.
Diff
diff --git a/secretsmanager/latest/userguide/troubleshoot_rotation.md b/secretsmanager/latest/userguide/troubleshoot_rotation.md index 5cbadcaf8..a0e655cb9 100644 --- a//secretsmanager/latest/userguide/troubleshoot_rotation.md +++ b//secretsmanager/latest/userguide/troubleshoot_rotation.md @@ -7 +7 @@ -Troubleshooting stepsNo activity after "Found credentials in environment variables"No activity after "createSecret"Error: "Access to KMS is not allowed"Error: "Key is missing from secret JSON"Error: "setSecret: Unable to log into database"Error: "Unable to import module 'lambda_function'"Upgrade an existing rotation function from Python 3.7 to 3.9Upgrade an existing rotation function from Python 3.9 to 3.10AWS Lambda secret rotation with PutSecretValue failedIntermittent rotation failures +Troubleshooting stepsNo activity after "Found credentials in environment variables"No activity after "createSecret"Error: "Access to KMS is not allowed"Error: "Key is missing from secret JSON"Error: "setSecret: Unable to log into database"Error: "Unable to import module 'lambda_function'"Upgrade an existing rotation function to Python 3.12AWS Lambda secret rotation with PutSecretValue failedIntermittent rotation failures @@ -33,3 +33 @@ Some services can manage secrets for you, including managing automatic rotation. - * Upgrade an existing rotation function from Python 3.7 to 3.9 - - * Upgrade an existing rotation function from Python 3.9 to 3.10 + * Upgrade an existing rotation function to Python 3.12 @@ -249 +247,3 @@ If you set up automatic secret rotation before December 20, 2021, your rotation -You might receive this error if you're running an earlier Lambda function that was automatically upgraded from Python 3.7 to a newer version of Python. To resolve the error, you can change the Lambda function version back to Python 3.7, and then Upgrade an existing rotation function from Python 3.7 to 3.9. For more information, see [Why did my Secrets Manager Lambda function rotation fail with a “pg module not found“ error?](https://repost.aws/knowledge-center/secrets-manager-lambda-rotation) in _AWS re:Post_. +You might receive this error if you're running an earlier Lambda function that was automatically upgraded from Python 3.7 to a newer version of Python. To resolve the error, you can change the Lambda function version back to Python 3.7, and then Upgrade an existing rotation function from Python 3.7 to Python 3.12. For more information, see [Why did my Secrets Manager Lambda function rotation fail with a “pg module not found“ error?](https://repost.aws/knowledge-center/secrets-manager-lambda-rotation) in _AWS re:Post_. + +## Upgrade an existing rotation function to Python 3.12 @@ -251 +251 @@ You might receive this error if you're running an earlier Lambda function that w -## Upgrade an existing rotation function from Python 3.7 to 3.9 +Secrets Manager is transitioning to Python 3.12 for Lambda rotation functions. To switch to a new rotation function that uses Python 3.12, you'll need to follow the upgrade path based on your deployment method and current rotation lambda Python version. Use the following procedures to upgrade both the Python version and the underlying dependencies. @@ -253 +253,3 @@ You might receive this error if you're running an earlier Lambda function that w -Some rotation functions created before November 2022 used Python 3.7. The AWS SDK for Python stopped supporting Python 3.7 in December 2023. For more information, see [Python support policy updates for AWS SDKs and Tools](https://aws.amazon.com/blogs/developer/python-support-policy-updates-for-aws-sdks-and-tools/). To switch to a new rotation function that uses Python 3.9, you can add a runtime property to an existing rotation function or recreate the rotation function. +### Upgrade an existing rotation function from Python 3.7 to Python 3.12 + +Some rotation functions created before November 2022 used Python 3.7. The AWS SDK for Python stopped supporting Python 3.7 in December 2023. For more information, see [Python support policy updates for AWS SDKs and Tools](https://aws.amazon.com/blogs/developer/python-support-policy-updates-for-aws-sdks-and-tools/). To switch to a new rotation function that uses Python 3.12, you can add a runtime property to an existing rotation function or recreate the rotation function. @@ -266 +268 @@ Some rotation functions created before November 2022 used Python 3.7. The AWS SD -###### To upgrade to Python 3.9: +###### To upgrade to Python 3.12: @@ -277 +279 @@ Some rotation functions created before November 2022 used Python 3.7. The AWS SD -### Option 1: Recreate the rotation function using CloudFormation +#### Option 1: Recreate the rotation function using CloudFormation @@ -287 +289 @@ The stack name is embedded in the ARN, as shown in the following example. - * ARN: `arn:aws:cloudformation:us-west-2:408736277230:stack/`SecretsManagerRDSMySQLRotationSingleUser5c2-SecretRotationScheduleHostedRotationLambda`-3CUDHZMDMBO8/79fc9050-2eef-11ed-80f0-021fb13c0537` + * ARN: `arn:aws:cloudformation:`aws-region`:123456789012:stack/`SecretsManagerRDSMySQLRotationSingleUser5c2-SecretRotationScheduleHostedRotationLambda`-3CUDHZMDMBO8/79fc9050-2eef-11ed-80f0-021fb13c0537` @@ -315 +317 @@ If a dialog box appears recommending you update the root stack, choose **Go to r -### Option 2: Update the runtime for the existing rotation function using CloudFormation +#### Option 2: Update the runtime for the existing rotation function using CloudFormation @@ -325 +327 @@ The stack name is embedded in the ARN, as shown in the following example. - * ARN: `arn:aws:cloudformation:us-west-2:408736277230:stack/`SecretsManagerRDSMySQLRotationSingleUser5c2-SecretRotationScheduleHostedRotationLambda`-3CUDHZMDMBO8/79fc9050-2eef-11ed-80f0-021fb13c0537` + * ARN: `arn:aws:cloudformation:`aws-region`:123456789012:stack/`SecretsManagerRDSMySQLRotationSingleUser5c2-SecretRotationScheduleHostedRotationLambda`-3CUDHZMDMBO8/79fc9050-2eef-11ed-80f0-021fb13c0537` @@ -342 +344 @@ If a dialog box appears recommending you update the root stack, choose **Go to r - 1. In the template JSON, for the `SecretRotationScheduleHostedRotationLambda`, under `Properties`, under `Parameters`, add `"runtime": "python3.9"`. + 1. In the template JSON, for the `SecretRotationScheduleHostedRotationLambda`, under `Properties`, under `Parameters`, add `"runtime": "python3.12"`. @@ -353 +355 @@ If a dialog box appears recommending you update the root stack, choose **Go to r -### Option 3: For AWS CDK users, upgrade the CDK library +#### Option 3: For AWS CDK users, upgrade the CDK library @@ -357,3 +359 @@ If you used the AWS CDK prior to version v2.94.0 to set up rotation for your sec -## Upgrade an existing rotation function from Python 3.9 to 3.10 - -Secrets Manager is transitioning from Python 3.9 to 3.10 for Lambda rotation functions. To switch to a new rotation function that uses Python 3.10, you'll need to follow the upgrade path based on your deployment method. Use the following procedures to upgrade both the Python version and the underlying dependencies. +### Upgrade an existing rotation function from Python 3.9 or later to Python 3.12 @@ -361 +361 @@ Secrets Manager is transitioning from Python 3.9 to 3.10 for Lambda rotation fun -###### To find which Lambda rotation functions use Python 3.9 +###### To find which Lambda rotation functions use an older version of Python @@ -367 +367 @@ Secrets Manager is transitioning from Python 3.9 to 3.10 for Lambda rotation fun - 3. In the filtered list of functions, under **Runtime** , look for `Python 3.9`. + 3. In the filtered list of functions, under **Runtime** , look for Python versions prior to `Python 3.12`. @@ -372 +372 @@ Secrets Manager is transitioning from Python 3.9 to 3.10 for Lambda rotation fun -### Update paths by deployment method +#### Update paths by deployment method @@ -437 +437 @@ Custom Lambda rotation functions -If you created custom Lambda rotation functions, you’ll need to upgrade each package dependencies and runtimes for these functions. For more information, see [Upgrade Lambda function runtime to latest version](https://repost.aws/knowledge-center/lambda-upgrade-function-runtime). +If you created custom Lambda rotation functions, you will need to upgrade each package dependencies and runtimes for these functions. For more information, see [Upgrade Lambda function runtime to latest version](https://repost.aws/knowledge-center/lambda-upgrade-function-runtime). @@ -472 +472 @@ If you experience issues updating the stack, [Determine the cause of a stack fai -To verify the Python upgrade, open the Lambda console ([https://console.aws.amazon.com/lambda/](https://console.aws.amazon.com/lambda/)) and access the **Function** page. Select the function you updated. Under **Code source** section, review the files included in the directory and ensure the Python .so file is version `3.10`. +To verify the Python upgrade, open the Lambda console ([https://console.aws.amazon.com/lambda/](https://console.aws.amazon.com/lambda/)) and access the **Function** page. Select the function you updated. Under **Code source** section, review the files included in the directory and ensure the Python .so file is version `3.12`.