Is there a design pattern for replacing a resource when a config var is

true

? I'd like to have a 'password reset' configuration option for some secrets in AWS secrets manager that would, when set, trigger a rotation. Was thinking about generating a random string to append to the resource name, or creating a dynamic resource that the rotation resource is dependent on, but both approaches have a couple of problems