secret_rotation_handler

secret_rotation_handler.py

def lambda_handler(event, context):
    # Current Secret via SSM
    current_secret = get_current_secret('/rds/PASSWORD')
    # Connect to RDS using current secret
    conn = get_connection(current_secret)
    # Generates new random secret
    new_secret = generate_secret()
    # Connects to RDS and rotate secret
    rotate_secret(conn, new_secret, current_secret)
    # IMPORT! checks if the new secret is valid before update any SSM parameter
    test_result = get_connection(new_secret)
    # If new secret succefully connects to RDS then update SSM for application
    if test_result != None:
        logger.info('Secret successfully rotated')
        update_parameter_ssm('/rds/PASSWORD', new_secret)
        database_url = build_db_url(new_secret)
        update_parameter_ssm('/rds/DATABASE_URL', database_url)
        # Restart application container
        restart_tasks()
    else:
        # If new secret is invalid SSM parameters remains current secret
        logger.info('Secret NOT rotated, SSM parameters not updated')