Rotating the LWA client secret is an asynchronous process. The new secret is delivered via an SQS queue subscribed to the APPLICATION_OAUTH_CLIENT_NEW_SECRET notification.
Rotation Workflow
- Subscribe: Use
amazonConnection.Notification.CreateSubscription with NotificationType.APPLICATION_OAUTH_CLIENT_NEW_SECRET and your destinationId (SQS). - Trigger: Call
amazonConnection.ApplicationManagement.RotateApplicationClientSecret(). The SDK handles the special auth path internally. - Receive: Poll SQS. The payload contains
NewClientSecret, NewClientSecretExpiryTime, and OldClientSecretExpiryTime.
Auto-applying Secrets
Use RotationApplyingMessageReceiver to wrap your existing NotificationService receiver. This automatically updates amazonConnection.Credentials with the new secret.
Important: You must persist all four fields from the payload to your database:
payload.ClientId: The row key.payload.NewClientSecret: Store encrypted.payload.NewClientSecretExpiryTime: When the new secret expires.payload.OldClientSecretExpiryTime: The deadline to finish the cutover (after this, only the new secret works).
// 1. Subscribe to rotation notifications
amazonConnection.Notification.CreateSubscription(new ParameterCreateSubscription
{
notificationType = NotificationType.APPLICATION_OAUTH_CLIENT_NEW_SECRET,
destinationId = yourSqsDestinationId,
payloadVersion = "1.0",
});
// 2. Trigger rotation
amazonConnection.ApplicationManagement.RotateApplicationClientSecret();
// 3. Auto-apply using RotationApplyingMessageReceiver
var wrapped = new RotationApplyingMessageReceiver(
inner: myReceiver,
credentials: amazonConnection.Credentials,
onRotated: payload =>
{
// Persist these to your DB
myDb.SaveRotatedSecret(
clientId: payload.ClientId,
newClientSecret: payload.NewClientSecret,
newClientSecretExpiresAt: payload.NewClientSecretExpiryTime,
oldClientSecretExpiresAt: payload.OldClientSecretExpiryTime);
});
NotificationService.StartReceivingNotificationMessages(param, wrapped);