TL;DR It absolutely can be done. There are two hurdles to overcome that don’t apply to traditional VPC-attached rotation functions: Data API can only use the AWSCURRENT version stage of a secret, so ...