Help Center/ Data Encryption Workshop/ User Guide/ Cloud Secret Management Service/ Managing Secrets/ Rotating Secret Version
Updated on 2025-09-15 GMT+08:00
View PDF
Share

Rotating Secret Version

If the secrets are not updated for a long time, the key information protected by the secrets, such as important passwords, tokens, certificates, SSH keys, and API keys, may be disclosed. Periodic secret rotation can enhance the security of the protected plaintext information. This section describes how to enable secret rotation.

Constraints

  • The secret must be a rotated secret.
  • The minimum rotation period is 4 hours.
  • The secret account must be an existing database account.

Manual Rotation

  1. Log in to the DEW console.
  2. Click in the upper left corner and select a region or project.
  3. In the navigation pane on the left, choose Cloud Secret Management Service > Secrets.
  4. Click a secret name to access its details page.
  1. In the Version area, click Rotate Now.
  2. In the displayed dialog box, enter ROTATE, and click OK.
  3. Wait until a message is displayed in the upper right corner, indicating the rotation starts now.
  4. After the version is rotated, the latest secret version is in SYSCURRENT state.

Automatic Rotation

  1. Log in to the DEW console.
  2. Click in the upper left corner and select a region or project.
  3. In the navigation pane on the left, choose Cloud Secret Management Service > Secrets.
  4. Click a secret name to access its details page.
  5. Click Set Rotation Policy in the upper right corner. In the displayed dialog box, enable Automatic Rotation, as shown in Figure 1.

    Figure 1 Automatic rotation

  6. Set an automatic rotation period, select the risk warning, and click OK. A message indicating the rotation policy is set successfully is displayed in the upper right corner.
  7. After automatic rotation is enabled, if the secret version fails to be rotated, you can view the number of rotation failures in the current version area. You can click the number of rotation failures to view the rotation failure records.

    • If the rotation fails for three consecutive times, the automatic rotation button of the secret is disabled.
    • Rotation failure records cannot be manually deleted. They are stored for one month and will be automatically deleted after one month.

Parent Topic: Managing Secrets