title: Password rotation on AWS DocumentDB
body: <p>We have a on-premise service that we want to move to AWS. </p>
  
  <p>I'm investigating the possibility of moving it, and I'm unsure about password rotation and storage. I know that Secrets Manager can be used with RDS quite well, but I'm unsure how suitable it is for DocumentDB</p>
  
  <p>When setting up a new DocumentDB cluster (using CF templates), it requires a master username and password. What would be the best approach to generating the password for this CF template? Could it be done using a secretsmanager:GetRandomPassword or is that bad practice?</p>