AWS Secrets Manager has a lovely feature: automatic rotation. You attach a rotation Lambda, set a schedule, and every 30 days your RDS password is rotated for you. Secure by default, no human involved.There's just one problem, and it's the one nobody mentions in the demo: your application has no idea it happened.