How do you safely rotate IAM credentials or database secrets without downtime?

Core Summary

The safe pattern is the "dual write" or "overlapping validity" approach: create the new secret, update your services to read both old and new, validate that it works, then stop writing to the old one. The timeline is usually: create new secret (instantly), deploy code that knows both (15 min), monitor (5 min), retire old secret (instantly). If you try to rotate instantly, the first request with the new secret will fail if it is not deployed yet.