Examkin

Question

Difficulty: MediumSecrets Management and Parameter Store

A developer is implementing a microservice in AWS Account A that needs to securely access a database credential managed in a centralized security AWS Account B. The microservice must access the credential directly without assuming an IAM role in Account B. Which approach should the developer use to meet these requirements?

  1. A
    Store the credential as a SecureString parameter in AWS Systems Manager Parameter Store in Account B, and attach a resource-based policy to the parameter that grants read permissions to the IAM execution role of the microservice in Account A.
  2. B
    Store the credential in AWS Systems Manager Parameter Store in Account A, and initialize the AWS SDK client inside the microservice code by hardcoding the AWS access key and secret key of an IAM user created in Account B.
  3. Store the credential in AWS Secrets Manager in Account B, attach a resource-based policy to the secret that allows the IAM execution role of the microservice in Account A to retrieve it, and encrypt the secret using an AWS KMS customer managed key that grants decryption permissions to Account A.Answer
  4. D
    Store the credential in AWS Secrets Manager in Account B, encrypt the secret using the default AWS managed key (aws/secretsmanager), and update the IAM execution role in Account A to allow decryption using the default AWS managed key.

Answer

Store the credential in AWS Secrets Manager in Account B, attach a resource-based policy to the secret that allows the IAM execution role of the microservice in Account A to retrieve it, and encrypt the secret using an AWS KMS customer managed key that grants decryption permissions to Account A.
The correct approach is to store the credential in AWS Secrets Manager in Account B, attach a resource-based policy to the secret to allow Account A's role to retrieve it, and use a customer managed KMS key that grants cross-account decryption permissions. AWS Secrets Manager supports resource-based policies, enabling direct access from another account without assuming a role. Additionally, default AWS managed KMS keys cannot be shared across accounts, necessitating a customer managed key.

Step-by-Step Solution

1
Determine the correct service that supports cross-account sharing via resource-based policies.
AWS Secrets Manager is chosen because Systems Manager Parameter Store does not support resource-based policies for cross-account access.
The requirement is to access the credential directly without assuming an IAM role, which requires resource-based authorization on the secret itself.
2
Establish encryption requirements for cross-account access using AWS KMS.
An AWS KMS customer managed key must be used instead of the default AWS managed key (aws/secretsmanager).
Default AWS managed KMS keys cannot be shared across accounts. A customer managed key is required so its key policy can be modified to grant decryption access to the IAM role in Account A.
3
Configure the resource-based policy on the secret.
Attach a resource policy to the Secrets Manager secret allowing the principal from Account A to perform the GetSecretValue action.
This allows the microservice's execution role in Account A to retrieve the secret payload directly.

Key Concept

Cross-account access capabilities and encryption configurations in AWS Secrets Manager versus Systems Manager Parameter Store.
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic