# Secret Rotation > Depth-first rabbithole dossier for Secret Rotation; source-anchored research pack. Parent: [Atlas Service Accounts](https://llms-explorer.com/tree/atlas-service-accounts/) · 3 facets · 20 facts · page: https://llms-explorer.com/tree/secret-rotation/ ## How it works - [low] In Model B rotation, the secret that is not replaced still triggers the Atlas 'Service Account Secrets are about to expire' alert each cycle. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/secret-rotation-4782936f25/rabbithole-synthesis.md#core` - [high] Service account secrets expire after a duration specified at creation, ranging from 8 hours to 365 days, and Atlas returns an alert when they are about to expire. Sources: https://www.mongodb.com/docs/atlas/tutorial/rotate-service-account-secrets.md, https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/secret-rotation-4782936f25/rabbithole-synthesis.md#core` - [high] Generating a new client secret causes the old secret to expire within 7 days, or sooner if its original expiration date is closer, ensuring an overlap of at most 7 days. Sources: https://www.mongodb.com/docs/atlas/tutorial/rotate-service-account-secrets.md, https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/secret-rotation-4782936f25/rabbithole-synthesis.md#core` - [low] Expired service account secrets are not deleted automatically and must be removed via the API, as losing all secrets before replacement results in loss of organization access. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/secret-rotation-4782936f25/rabbithole-synthesis.md#core` - [low] When a provider authenticates using a Service Account, the `MONGODB_ATLAS_CLIENT_SECRET` credential must be updated to the new secret value before the next Terraform plan or apply to avoid HTTP 401 errors. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/secret-rotation-4782936f25/rabbithole-synthesis.md#troubleshooting` - [low] Terraform configurations for multiple secrets require `depends_on` to prevent parallel creation, which can cause HTTP 409 Conflict errors, and replacing one secret shortens the expiration of the other to 7 days. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/secret-rotation-4782936f25/rabbithole-synthesis.md#troubleshooting` ## Problems, failure modes and limitations - [high] The full client secret for a service account is displayed only once at creation and must be saved to a secure location, as it cannot be viewed again without generating a new secret. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md, https://veryfront.com/docs/cloud/integrations/mongodb-atlas.md, https://www.mongodb.com/docs/atlas/tutorial/rotate-service-account-secrets.md, https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md, https://www.pulumi.com/registry/packages/mongodbatlas/api-docs/service — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/secret-rotation-4782936f25/rabbithole-synthesis.md#core` - [high] Creating a Service Account with `without_initial_secret = true` requires provider v2.19.0 or later and cannot be set on existing accounts; this attribute prevents generating an initial secret. (verified as of 2026-10-15) Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md, https://www.pulumi.com/registry/packages/mongodbatlas/api-docs/serviceaccount/, https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/resources/service_account.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/secret-rotation-4782936f25/rabbithole-synthesis.md#core` - [low] When an Atlas Organization Service Account secret expires, Atlas Search's mongot process retains the expired secret in its internal auth cache, causing $vectorSearch aggregations to fail with authentication errors. Sources: https://feedback.mongodb.com/ideas/CUSTOMER-I-10601 — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/secret-rotation-4782936f25/rabbithole-synthesis.md#troubleshooting` - [low] A plain Terraform replace that destroys a secret before creating a new one fails with an HTTP 401 error. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/secret-rotation-4782936f25/rabbithole-synthesis.md#troubleshooting` - [low] If the Terraform provider authenticates using the secret being replaced, a plain Terraform replace that destroys the secret before creating a new one fails with an HTTP 401 error, because Atlas revokes the OAuth token as soon as the secret that minted it is deleted. Using lifecycle { create_before_destroy = true } avoids this. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/migrate-pak-to-service-account.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/secret-rotation-4782936f25/rabbithole-synthesis.md#troubleshooting` ## Facts and statements - [low] The `client_id` remains constant during secret rotation, while only the secret value changes, and Terraform deletes the replaced secret automatically during apply. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/secret-rotation-4782936f25/rabbithole-synthesis.md#core` - [low] Secret rotation supports self-rotation mode (default) where the service account uses its own credentials, and admin-assisted mode using a separate admin service account credential for accounts lacking self-management permissions. Sources: https://docs.aws.amazon.com/secretsmanager/latest/userguide/mes-partner-MongoDBAtlasServiceAccount.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/secret-rotation-4782936f25/rabbithole-synthesis.md#core` - [low] During rotation, the driver creates a new secret via the Atlas Admin API, verifies it by generating an OAuth token, updates the secret, and deletes the old secret. Sources: https://docs.aws.amazon.com/secretsmanager/latest/userguide/mes-partner-MongoDBAtlasServiceAccount.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/secret-rotation-4782936f25/rabbithole-synthesis.md#core` - [low] For admin-assisted rotation, an Admin Secret in AWS Secrets Manager containing the admin service account's `clientId` and `clientSecret` must be created and its ARN provided in the RotateSecret call. Sources: https://docs.aws.amazon.com/secretsmanager/latest/userguide/mes-partner-MongoDBAtlasServiceAccount.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/secret-rotation-4782936f25/rabbithole-synthesis.md#core` - [low] Secrets can be created using the CreateSecret call with secret type MongoDBAtlasServiceAccount, and rotation configurations are set via the RotateSecret call. Sources: https://docs.aws.amazon.com/secretsmanager/latest/userguide/mes-partner-MongoDBAtlasServiceAccount.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/secret-rotation-4782936f25/rabbithole-synthesis.md#core` - [low] Each Atlas service account has a client ID and a rotatable secret that function as a username and password for creating access tokens. Sources: https://www.mongodb.com/docs/atlas/api/api-authentication.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/secret-rotation-4782936f25/rabbithole-synthesis.md#core` - [high] A Service Account and an MCP configuration can each hold at most two secrets, and Atlas revokes an OAuth token as soon as the secret that minted it is deleted. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md, https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/secret-rotation-4782936f25/rabbithole-synthesis.md#core` - [low] The account issuing the Terraform apply command needs a role that can manage its own secrets, such as ORG_OWNER, if authenticating as the Service Account itself. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/secret-rotation-4782936f25/rabbithole-synthesis.md#core` - [low] Atlas auto-triggered HOST_MONGOT_RESTARTED events do not clear the stale auth cache state, so the expired secret must be explicitly deleted via the Admin API to resolve $vectorSearch failures. Sources: https://feedback.mongodb.com/ideas/CUSTOMER-I-10601 — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/secret-rotation-4782936f25/rabbithole-synthesis.md#troubleshooting` ## Related concepts - Secret — is a part of Secret Rotation - Rotation — is a part of Secret Rotation