Examkin

Question

Difficulty: EasySecurity and Compliance Control Design

A company is deploying a new service in a multi-account environment. An Amazon ECS task running in Account B must retrieve a database credential stored in AWS Secrets Manager in Account A. The secret is encrypted using the default AWS-managed KMS key (aws/secretsmanager). A resource-based policy has been attached to the secret in Account A, granting read permissions to the IAM role of the ECS task in Account B. However, the ECS task still receives an access denied error when attempting to retrieve the credential. Which action must the Solutions Architect take to resolve this issue?

  1. A
    Modify the key policy of the default AWS-managed KMS key (aws/secretsmanager) in Account A to grant KMS decrypt permissions to the ECS task IAM role in Account B.
  2. Re-encrypt the secret in Account A using a customer managed KMS key, configure the key policy of the customer managed KMS key to allow cross-account access from Account B, and grant KMS decrypt permissions to the ECS task IAM role in Account B.Answer
  3. C
    Attach a Service Control Policy (SCP) to the Organizational Unit of Account A that explicitly allows cross-account decryption operations for all roles in the organization.
  4. D
    Configure the IAM role of the ECS task in Account B with a trust policy that trusts the AWS KMS service in Account A, allowing the role to assume the KMS key's permissions directly.

Answer

Re-encrypt the secret in Account A using a customer managed KMS key, configure the key policy of the customer managed KMS key to allow cross-account access from Account B, and grant KMS decrypt permissions to the ECS task IAM role in Account B.
Re-encrypting the secret with a customer managed KMS key is required because AWS-managed KMS keys (like aws/secretsmanager) cannot be shared across accounts. A customer managed KMS key's policy can be updated to trust Account B, and the IAM role in Account B can then be granted decrypt permissions.

Step-by-Step Solution

1
Identify the encryption configuration of the Secrets Manager secret.
The secret is encrypted with the default AWS-managed KMS key (aws/secretsmanager).
AWS-managed KMS keys cannot be shared across accounts, meaning any cross-account access will fail regardless of resource policies.
2
Create a customer managed KMS key in Account A and re-encrypt the secret with it.
The secret is now encrypted with a key whose policy can be modified.
Customer managed KMS keys support policy modifications, allowing cross-account access delegation.
3
Update the customer managed KMS key policy in Account A and the IAM role in Account B.
The KMS key policy allows Account B to use the key, and the ECS task's IAM role permits the kms:Decrypt action.
Both the key policy and the consumer's IAM policy must explicitly allow the decryption operation to complete the cross-account permission chain.

Key Concept

Cross-account AWS KMS access constraints and differences between AWS-managed keys and customer managed keys.
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic