title: Secrets Manager Redshift credential Rotation fails with "Unable to log into database"
body: <p>I have set a new Secrets Manager Credential for connecting to Redshift with rotation enabled, following this <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/tutorials_db-rotate.html#tut-db-rotate-step4" rel="nofollow noreferrer">tutorial</a> but for Redshift. When I save the secret, although a message stating that the secret is successfully stored and the rotation is enabled, the secret rotation is not working. Credentials must rotate once just afert enabling rotation but I the password never changes. Then, every time a try to force credentials rotation, an error is deplayed saying that &quot;A previous rotation isn't complete&quot;.</p>
  <p>I have checked the logs in CloudWatch and I can see the following error:</p>
  <blockquote>
  <p>[ERROR] ValueError: Unable to log into database with previous, current, or pending secret of secret arn...</p>
  </blockquote>
  <p>My Redshift cluster is deployed in a private VPC and is not publicly accessible. However, I have verified that:</p>
  <ol>
  <li>The lambda (generated and configured automatically by the SMM) is running in the same VPC as Redshift does and they have the same security group.</li>
  <li>The lambda has the corresponding permissions for secret manager, cloudwatch and EC2 services.</li>
  <li>The VPC has a public NAT Gateway configured. Thus, a private endpoint should not be needed.</li>
  <li>Stored Redshift credentials are correct as I am able to connect from python or DBeaver (ssh tunel) with them.</li>
  </ol>
  <p>Am I missing something?</p>