(aws-docdb): password rotation should work

[ahammond]

What is the problem?

aws_docdb.DatabaseCluster.addRotationSingleUser() secret rotator fails

Reproduction Steps

    const cluster = new aws_docdb.DatabaseCluster(this, 'Database', { ... });
    cluster.addRotationSingleUser();

Go to SecretsManager, find the associated secret and click the "Rotate secret immediately". Note error message with "A previous rotation isn't complete."

What did you expect to happen?

Secret rotation should succeed.

What actually happened?

Fail to rotate the secret "... secret name ..."

CDK CLI Version

2.0.0-rc.24

Framework Version

2.0.0-rc.24

Node.js Version

v14.17.5

OS

MacOS

Language

Typescript

Language Version

4.4.3

Other information

No response

[skinny85]

@ahammond can you share your CDK code?

I wonder if this is similar to #17265 for RDS.

[asterikx]

@ahammond the same error message was shown to me in #17265. Since the Lambda could not connect to the DB the rotation did not complete and any subsequent (manual) rotation failed with that error message.
You might experience the same problem. Is your cluster located in a public or an isolated subnet of your VPC?

[ahammond]

@asterikx I just checked and both the DocDB and the rotator Lambda are deployed in a Private subnet w/ an IGW. I see that the SG for the lambda is allowed ingress on the SG for the DocDB. The lambda's role has permissions on the secret. Logs from the lambda look like a bunch of this:

START RequestId: 6cedee30-6771-4b9c-ae3b-48a8bd055473 Version: $LATEST
[INFO]	2021-11-04T20:16:21.402Z	6cedee30-6771-4b9c-ae3b-48a8bd055473	Found credentials in environment variables.
END RequestId: 6cedee30-6771-4b9c-ae3b-48a8bd055473
REPORT RequestId: 6cedee30-6771-4b9c-ae3b-48a8bd055473	Duration: 30030.53 ms	Billed Duration: 30000 ms	Memory Size: 128 MB	Max Memory Used: 69 MB	Init Duration: 442.54 ms
2021-11-04T20:16:51.180Z 6cedee30-6771-4b9c-ae3b-48a8bd055473 Task timed out after 30.03 seconds

So... yeah, it looks like it's having trouble connecting to the DocDB, but I'm at a loss for why.