This role should have below policy document associated to it:

A VPC endpoint to access Secrets Manager without going out of VPCįirst, we create an IAM role to be attached to a Lambda function, which we will create in the next step and use it for rotating the AppSyc API keys.

A secret in Secrets Manager with a secret configured.

Make sure you have below resources in place before move to the rest of this post.

To illustrate the process, I'm going to host the code in the Lambda function, and let the Secrets Manger to invoke the Lambda function with a pre-defined rotation interval. To automatically rotate the API key, we need to write code to achieve the goal. The AppSync service is not able to rotated the key automatically. Then an application code could retrieve the key via API calls, and we can manage key rotation policy in the Secrets Manager as well. When using API key for authentication, we normally store the key in the Secrets Manager service. You just have to specify the same URL in the liquibase configuration and the database secret as the username and the liquibase setup will work for you.There are four ways you can authorize applications to interact with your AWS AppSync GraphQL API, including API_KEY, AWS_IAM, OPENID_CONNECT, and AMAZON_COGNITO_USER_POOLS. This also works if you have liquibase integration in place. Here is a GitHub link to my implementation.

You can test this by clicking on the rotate secret option in the secret which will generate a new password for database and check the communication with the database.

Now start the application and it should be able to communicate with AWS Secrets Manager to fetch the credentials and start communicating with the AWS RDS instance. With this, you are done with the changes. Once you have this in place, your application can connect to AWS by exporting the environment variable AWS_PROFILE with the profile you setup while configuring the AWS configuration. Now, For the application to communicate with AWS and fetch the secret value, you would have to have AWS CLI setup and configured. Spring : datasource : url : jdbc-secretsmanager:mysql://database-host:3306/rotate_db username : secret/rotation driver-class-name : .AWSSecretsManagerMySQLDriver

Aws secret manager rotation