# Rotate the secrets

> Regenerate the secrets in Amazon Web Services Secrets Manager

Amazon Web Services (AWS) Secrets Manager stores the [secrets](../installation/security#secrets).

When rotating secrets, consider the requirements:

* For most secrets, you don't need to take additional steps.
* For Keycloak client secrets, you must rotate the secrets using the Keycloak admin console and in the Terraform configuration.

## Rotate the mini-usf Keycloak client secret

Because the default mini-usf client secret isn't randomly generated, you must rotate it.

To regenerate the secret, complete these steps:

1. In the Keycloak admin console, switch to the **unity** realm.

2. Go to **Manage** > **Clients**, and then select the **mini-usf** client.

3. On the **Credentials** tab, select **Regenerate** next to the client secret.

4. Copy the secret to the clipboard.

5. Save the secret:

   1. Use the copied secret to redefine the **keycloak\_mini\_usf\_clientsecret** variable in the directory `aws/terraform/tfvars/{region}.tfvars`.
   2. From the directory `aws/terraform`, run this command:

   ```sh
   make apply-us-east-1
   ```

6. To restart the mini-usf pods in Kubernetes and apply the new secret, run this command:

   ```sh
   kubectl rollout restart deployment -n asset-solutions mini-usf
   ```