Examkin

Question

Difficulty: HardAWS Serverless Application Model (SAM)

A developer uses AWS Serverless Application Model (SAM) to deploy a Lambda function that retrieves database credentials from AWS Secrets Manager. The secret is encrypted using a customer managed AWS KMS key. In the SAM template, the developer configures the function's `Policies` property with the `AWSSecretsManagerGetSecretValuePolicy` template, referencing the secret's ARN. The deployment completes successfully. However, when the function runs, it fails with an `AccessDeniedException` during the `GetSecretValue` API call. What is the reason for this runtime failure?

  1. The `AWSSecretsManagerGetSecretValuePolicy` policy template only grants permissions for the `secretsmanager:GetSecretValue` action, meaning the function execution role still lacks permissions to decrypt the secret using the customer managed KMS key.Answer
  2. B
    AWS SAM policy templates do not support AWS Secrets Manager directly, requiring the developer to migrate the database credentials to Systems Manager Parameter Store and use the `SSMParameterReadPolicy` template.
  3. C
    The default execution role generated by AWS SAM does not include a trust policy that allows the AWS Secrets Manager service principal to assume the role to deliver the secret.
  4. D
    The developer did not include the `Transform: AWS::Serverless-2016-10-31` declaration in the template, causing AWS CloudFormation to ignore the SAM policy template and strip all permissions from the IAM execution role.

Answer

The Lambda function's execution role lacks explicit decrypt permissions on the customer managed KMS key, as the pre-defined `AWSSecretsManagerGetSecretValuePolicy` SAM policy template only grants permission for the `secretsmanager:GetSecretValue` action.
The correct answer is correct because the built-in AWS SAM policy template `AWSSecretsManagerGetSecretValuePolicy` only grants the Lambda function permission to call `secretsmanager:GetSecretValue` on the specified resource. If the secret is encrypted with a customer managed KMS key (rather than the default AWS-managed key `aws/secretsmanager`), the function's IAM execution role must also be granted explicit `kms:Decrypt` permissions on that KMS key to successfully read the decrypted payload.

Step-by-Step Solution

1
Analyze the IAM policy generated by the `AWSSecretsManagerGetSecretValuePolicy` template.
The generated policy grants access to `secretsmanager:GetSecretValue` for the target secret resource.
To verify the scope of the permissions granted to the Lambda function's execution role by default.
2
Identify the encryption mechanism of the secret.
The secret is encrypted using a customer managed KMS key.
Secrets encrypted with customer managed keys require explicit KMS decrypt permissions for any identity attempting to read them.
3
Determine why the call fails with AccessDeniedException at runtime.
While the function can access Secrets Manager, the decryption fails because the execution role does not possess the `kms:Decrypt` permission on the customer managed key.
Both Secrets Manager and KMS permissions must be present in the execution role for successful retrieval of KMS-encrypted secrets.

Key Concept

AWS SAM Policy Templates and KMS Decrypt Permissions
Estimated Time:2m 0s
Rate this question

Topics

AWS Serverless Application Model (SAM)

More questions from this topic