You can change secrets regularly, but if you don't change them often enough then you can still be compromised because of it. If you change them too often then

You can change secrets regularly, but if you don't change them often enough then you can still be compromised because of it. If you change them too often then it's a maintenance problem. You might even take an outage because you have mismatched credentials (i.e. application or database had the database credentials updated but the other one didn't) Changing them regularly IS necessary. So if you're going to do it you should use a credential service like Hashicorp Vault.