Automatic Failover for AWS Secret Manager
under review
R
Rubber Scallop
As a platform/DevOps engineer
I want the AWS Secret Manager to automatically fail over across regions
So that pipelines and workloads can continue operating during a regional outage without manual intervention.
We must meet internal resiliency requirements that services continue operating when a region is degraded or unavailable.
Today, a region outage (or inability to reach the region endpoint) can block secret retrieval, which can block deployments and runtime operations.
Core capability
When retrieving secrets, the AWS Secret Manager should:
1) Detect if the current region is unavailable (health/connection failures/timeouts).
2) Fail over automatically to a configured alternate region that is available.
3) Return the secret if the alternate region is healthy.
4) If no regions are available, fail fast with a clear error indicating both regions were attempted and why each failed.
Configuration
1) Support configuration of primary + secondary region (optionally N regions).
2) Support an explicit failover order (primary → secondary).
A
Abhishek Thamman
Hey Standard Opossum, this makes sense. We are exploring how we can add support for the secondary region in the AWS Secret Manager connector. Please note that the AWS SDK doesn't provide built-in support for automatic failover for cross-region secrets, and this would need custom logic to identify region unavailability. We would need to rely on timeouts due to connectivity issues, and this would increase the overall connectivity/permanently fail when attempting. Please let me know if this approach sounds good.
Also, can you please let me know how many secondary regions you would want to specify?
Prateek Mittal
updated the status to
under review
S
Standard Opossum
The enhancement request pertains to the AWS Secret Manager connector in Harness. Currently, the connector requires the selection of a single region, which limits its flexibility. Although AWS secrets are replicated across regions, the connector remains tied to one region and cannot automatically switch to another without manual intervention. To improve resilience and operational efficiency, the connector should either eliminate the mandatory region selection - defaulting to the delegate’s region - or provide support for multiple or secondary regions.
Photo Viewer
View photos in a modal
Prateek Mittal
Hi Jackie,
I researched the ask and AWS Secrets Manager supports multi-Region secret replication, which automatically copies secret values, metadata, tags, and automatic rotation updates to read replicas in other AWS Regions. You can enable replication for a secret using the AWS Console. Please let me know if we need to further discuss this.
R
Rubber Scallop
Automatic Failover for AWS Secret Manager* I can't edit the request
Gino Orvieto
Rubber Scallop, updated the title and description