Terraform AWS Provider 6.62.0: Disable Managed Secret Rotation When You Need To

The Terraform AWS provider 6.62.0 (August 26, 2026) includes a small but useful Secrets Manager change: you can now turn off automatic rotation on a secret when AWS is already managing that lifecycle for you.

What changed

For aws_secretsmanager_secret_rotation:

• rotation_enabled is configurable (it used to be read-only).
• You can set rotation_enabled = false to disable rotation.
• rotation_rules is now optional, and must be omitted when rotation is disabled.

The release notes call out a practical case: RDS master user password secrets created with manage_master_user_password, where rotation is otherwise managed by AWS and fighting Terraform’s rotation resource causes pain.

Why it matters

Managed database passwords and Secrets Manager rotation often collide in real Terraform modules. Being able to explicitly disable rotation in the provider is cleaner than workarounds, ignores, or splitting ownership across two tools.

Who should care

• Anyone using Terraform with RDS + manage_master_user_password
• Teams that wrap Secrets Manager rotation in shared modules
• Readers following Daily Code Guide Terraform / AWS tracks

What to do next

1. Review modules that declare aws_secretsmanager_secret_rotation
2. Upgrade the AWS provider toward 6.62.0+ in a non-prod workspace first
3. If AWS already rotates the secret, set rotation_enabled = false and remove rotation_rules
4. Plan carefully — rotation settings affect live credentials

Source

terraform-provider-aws v6.62.0 release notes