What is the MOST likely cause of the authentication errors?
Migrating the credential to RDS requires that all access come through requests to the Secrets Manager.
Enabling rotation in Secrets Manager causes the secret to rotate immediately, and the applications are using the earlier credential.
The Secrets Manager IAM policy does not allow access to the RDS database.
The Secrets Manager IAM policy does not allow access for the applications.
Explanations:
Secrets Manager manages the secret but does not enforce database access to occur exclusively through it.
Enabling rotation immediately generates a new secret, and applications still using the old credential would fail.
The IAM policy for Secrets Manager does not control access to the RDS database itself.
This IAM policy issue would prevent applications from retrieving the secret, but not cause authentication errors if they have the previous credentials.
I figure that the answer is:
Enabling rotation in Secrets Manager causes the secret to rotate immediately, and the applications are using the earlier credential.