Secret manager plugin credential rotation behavior

Short answer

DBeaver's secret manager plugins (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) fetch credentials at connection time, not on a schedule. If the secret is rotated, you must trigger a new connection attempt — DBeaver does not transparently detect rotation on an already-open connection. There is no documented TTL or refresh interval setting for external credentials. The practical rule: rotated secrets take effect on the next connect, and you should plan around reconnecting rather than waiting for automatic pickup.

What is confirmed vs. what is likely

Confirmed: the master password encryption only covers locally stored credentials; runtime-fetched secrets are outside its scope. The documentation does not document a TTL option for external secret caching.

Likely, but version-dependent: plugins fetch secrets at connection establishment and hold them for the life of that connection. There is no documented notification path from Vault/AWS to DBeaver — DBeaver is a pull client; it cannot know a rotation happened until it fetches again. A new connection attempt is required to pick up rotated credentials.

Answers to your three questions

1. Fetch timing: Secrets are retrieved when a connection is initiated. Caching, where present, is scoped to the individual connection lifecycle and is not persisted across reconnects.
2. Rotation: DBeaver cannot detect rotation transparently. After a rotation, you must reconnect — either manually or by letting the connection fail and retrying. A new connection attempt fetches the current secret value.
3. TTL: There is no documented TTL or refresh interval setting for external credentials in the default plugin settings. The fetch-on-connect model means the TTL is effectively the connection lifetime.

Verification steps

To confirm behavior on your version, do a rotation test: update the secret in Vault or AWS Secrets Manager, then open a new connection in DBeaver and check whether the new credential is accepted. Enable debug logging and look for secret fetch timestamps relative to connection establishment. If the new credential works without manual intervention, the plugin re-fetches on connect; if it fails, the plugin is caching and requires a manual reconnect.

Caveats and version assumptions

Plugin behavior varies across DBeaver versions. Newer releases may include re-fetch mechanisms or TTL options absent in older builds. If you are on an older version, assume the fetch-on-connect model until proven otherwise. Also note: if the plugin re-fetches on every connection attempt, external secret manager authentication expiration could cause failures independent of rotation. Test rotation behavior on your exact DBeaver and plugin versions before relying on any assumption.