Examkin

Question

Difficulty: Very hardIdentity and Access Management (IAM)

A multinational corporation is implementing a centralized deployment pipeline. A containerized microservice hosted on Amazon ECS in a Shared Services account (Account ID: 888888888888888888888888) must dynamically retrieve runtime secrets and database credentials from AWS Secrets Manager located in a Production database account (Account ID: 999999999999999999999999). The Secrets Manager secret is encrypted using a Customer Managed Key (CMK) in the Production database account. The container in Account 888888888888888888888888 runs under an IAM task role named `EcsSharedTaskRole`. The architecture must enforce the principle of least privilege and prevent the storage of long-term credentials.

Which combination of configuration steps is required to securely enable this cross-account retrieval? (Select TWO.)

  1. Attach an identity-based policy to `EcsSharedTaskRole` in Account 888888888888888888888888 that allows `secretsmanager:GetSecretValue` on the Production secret ARN and `kms:Decrypt` on the Customer Managed Key ARN. Update the secret's resource-based policy in Account 999999999999999999999999 to grant `secretsmanager:GetSecretValue` to the `EcsSharedTaskRole` ARN.Answer
  2. Configure the key policy of the Customer Managed Key in Account 999999999999999999999999 to grant `kms:Decrypt` permissions to `arn:aws:iam::888888888888:role/EcsSharedTaskRole`.Answer
  3. C
    Create a dedicated IAM user in Account 999999999999999999999999 with a permission policy allowing secrets retrieval, generate long-term access keys, and configure the ECS task definition to pass these keys as environment variables to the container.
  4. D
    Replicate the secret values into the Systems Manager Parameter Store in Account 888888888888888888888888 as standard, unencrypted parameters to eliminate the need for cross-account KMS decryption and IAM task role configuration.
  5. E
    Configure the ECS task to run using the AWS account root user credentials of Account 888888888888888888888888, and update the KMS key policy in Account 999999999999999999999999 to trust the root user of Account 888888888888888888888888 for all actions.

Answer

The correct configuration requires attaching an identity-based policy to the task role that allows secrets retrieval and decryption, granting the task role access in the secret's resource policy, and updating the KMS key policy to permit decryption by the task role.
To establish secure cross-account access to an encrypted secret in Secrets Manager, you must grant permissions on both sides of the account boundary. First, the IAM identity (the task role) in the consuming account must have an identity-based policy that allows accessing the secret and using the KMS key. Second, the secret's resource-based policy must explicitly permit the consuming role. Third, the KMS key policy in the producing account must trust the consuming role to perform decrypt operations. This direct delegation configuration satisfies the principle of least privilege.

Step-by-Step Solution

1
Configure identity-based permissions in the source account
The ECS task role has the necessary permissions to call cross-account APIs.
Before an IAM identity can access a resource in another account, it must be explicitly permitted by its own identity-based policy.
2
Configure the resource-based policy on the target secret
Secrets Manager permits the cross-account role to retrieve the secret value.
Cross-account access requires permission from the resource owner; the resource-based policy must explicitly list the external IAM role as an allowed principal.
3
Configure the KMS key policy on the Customer Managed Key
The external IAM role is allowed to decrypt the data key used to encrypt the secret payload.
Since the secret is encrypted with a Customer Managed Key, the key policy must trust the cross-account role principal. Identity-based policies alone cannot grant access to cross-account KMS keys without key policy cooperation.

Key Concept

Cross-account access delegation using IAM roles, resource-based policies, and KMS key policies under the principle of least privilege.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic