Examkin

Question

Difficulty: HardStrengthening Identity, Access, and Network Security

An enterprise runs an application hosted on Amazon ECS tasks using the AWS Fargate launch type inside a private subnet of VPC A in Account A (Production). The application needs to retrieve database credentials from AWS Secrets Manager in Account B (Shared Services). The secret is encrypted using an AWS KMS Customer Managed Key (CMK) in Account B. In addition, the application must resolve private DNS records for services in Account B, which are defined in a Route 53 Private Hosted Zone (PHZ) in Account B.

Currently, all traffic from VPC A to Secrets Manager traverses the public internet via NAT Gateways, and the application cannot resolve the private DNS names of the resources in Account B. The Solutions Architect must strengthen the identity, access, and network security posture of this existing solution by keeping all traffic within the AWS private network and using least-privilege access.

Which TWO actions should the Solutions Architect take to meet these requirements?

  1. Create an Interface VPC Endpoint for AWS Secrets Manager in VPC A. Update the key policy of the Customer Managed Key in Account B to grant kms:Decrypt permissions to the ECS task role in Account A. Attach an IAM policy to the ECS task role in Account A that permits the secretsmanager:GetSecretValue action.Answer
  2. From Account B, authorize the association of the Route 53 Private Hosted Zone with VPC A using the AWS CLI or SDK. From Account A, associate the Route 53 Private Hosted Zone with VPC A.Answer
  3. C
    Encrypt the secret in Account B using the default AWS managed key (aws/secretsmanager), and modify the AWS managed key policy to grant the ECS task role in Account A decrypt permissions.
  4. D
    Attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing Account A that grants the ECS task role the secretsmanager:GetSecretValue and kms:Decrypt permissions, removing the need for local IAM policies.
  5. E
    Route DNS queries from VPC A to the Amazon-provided DNS server (169.254.169.253169.254.169.253) in VPC B over a Transit Gateway attachment, without associating the Private Hosted Zone with VPC A.

Answer

Create an Interface VPC Endpoint for AWS Secrets Manager in VPC A, configure cross-account access using a Customer Managed Key with modified key policies, and associate the Route 53 Private Hosted Zone in Account B with VPC A.
Establishing an Interface VPC Endpoint for AWS Secrets Manager ensures that traffic between VPC A and Secrets Manager remains within the AWS network. For cross-account access to the secret, a Customer Managed Key (CMK) must be used because its key policy can be modified to grant decrypt permissions to the external ECS task role, and the ECS task role itself must have the corresponding Secrets Manager permission. Additionally, associating the Route 53 Private Hosted Zone in Account B with VPC A enables VPC A to resolve the private DNS names directly via the VPC's local resolver.

Step-by-Step Solution

1
Deploy an Interface VPC Endpoint for AWS Secrets Manager in VPC A.
Traffic between the ECS tasks in VPC A and the Secrets Manager service endpoint routes privately within the AWS network.
This satisfies the requirement to prevent traffic from traversing the public internet via NAT Gateways.
2
Configure cross-account key and identity policies for Secrets Manager.
The ECS task role in Account A is granted permissions to read the secret, and the key policy of the Customer Managed Key in Account B is updated to permit decryption by the task role.
Because AWS managed keys cannot be modified or shared cross-account, a Customer Managed Key is required to delegate decrypt privileges securely.
3
Associate the Route 53 Private Hosted Zone from Account B with VPC A.
VPC A's Amazon-provided DNS resolver can resolve the private hostnames defined in Account B's hosted zone.
A Private Hosted Zone cannot resolve names in VPCs of other accounts unless an association is authorized from the owner account and completed by the consumer account.

Key Concept

Cross-account resource access requires configuring a Customer Managed Key (since AWS managed keys cannot be modified) and updating both IAM and key policies. Cross-account Route 53 Private Hosted Zone resolution requires explicit authorization and association.
Rate this question

Topics

Strengthening Identity, Access, and Network Security