Examkin

Question

Difficulty: MediumStrengthening Identity, Access, and Network Security

An enterprise runs an application on Amazon EC2 instances inside a private subnet in VPC A under AWS Account A. The application must retrieve sensitive database credentials stored in AWS Secrets Manager inside a central security account (Account B). Currently, the EC2 instances access Secrets Manager via an Interface VPC Endpoint (AWS PrivateLink) created in VPC A. To strengthen network and identity security, the solutions architect must ensure that only these specific application EC2 instances can retrieve this particular secret, and that no other resources in VPC A can use the Interface VPC Endpoint to access Secrets Manager. Which combination of actions will meet these requirements?

  1. Configure the VPC Endpoint policy on the Secrets Manager interface endpoint in VPC A to allow secretsmanager:GetSecretValue for the secret ARN in Account B only when the principal is the application's IAM role. Configure the secret resource policy in Account B to allow the IAM role to retrieve the secret. Encrypt the secret using a customer managed KMS key in Account B, and update its key policy to grant the application's IAM role kms:Decrypt permissions. Set the VPC endpoint's security group to only allow inbound traffic from the application EC2 instances' security group.Answer
  2. B
    Configure the VPC Endpoint policy on the Secrets Manager interface endpoint in VPC A to allow secretsmanager:GetSecretValue for the secret ARN in Account B only when the principal is the application's IAM role. Configure the secret resource policy in Account B to allow the IAM role to retrieve the secret. Encrypt the secret using the default AWS managed key (aws/secretsmanager) in Account B, and configure a Service Control Policy (SCP) in Account B to permit Account A's IAM role to decrypt using this key. Set the VPC endpoint's security group to only allow inbound traffic from the application EC2 instances' security group.
  3. C
    Create a Service Control Policy (SCP) at the root of the AWS Organization that explicitly grants secretsmanager:GetSecretValue and kms:Decrypt permissions for the application's IAM role to access Account B resources. In VPC A, configure the VPC Endpoint policy to allow all principals (*) to access the Secrets Manager endpoint. Use the default AWS managed key for Secrets Manager in Account B to encrypt the secret. Set the VPC endpoint's security group to only allow inbound traffic from the application EC2 instances' security group.
  4. D
    Configure the VPC Endpoint policy on the Secrets Manager interface endpoint in VPC A to allow secretsmanager:GetSecretValue for the secret ARN in Account B for all principals. In Account B, share the customer managed KMS key and the database secret with Account A using AWS Resource Access Manager (RAM). Set the security group on the Interface VPC Endpoint to allow inbound traffic from the entire VPC A CIDR block.

Answer

Configure the VPC Endpoint policy to allow only the application's IAM role to access the secret in Account B, use a customer managed KMS key in Account B with a key policy allowing cross-account decryption, configure the secret resource policy to trust the role, and restrict the endpoint security group to allow inbound traffic only from the application EC2 instances' security group.
The correct solution uses a customer managed KMS key (CMK) in Account B with a key policy that grants decrypt permissions to the cross-account role in Account A. This is necessary because AWS-managed keys cannot have their key policies modified for cross-account access. In addition, configuring the VPC endpoint policy to restrict access to the specific IAM role and target secret ARN, combined with a security group that limits inbound traffic to only the application's security group, ensures both network and identity-level security constraints are met.

Step-by-Step Solution

1
Ensure the KMS key used for the secret supports cross-account delegation.
Use a Customer Managed Key (CMK) instead of the default AWS managed key (aws/secretsmanager), and modify the key policy in Account B to grant kms:Decrypt permissions to the application IAM role in Account A.
AWS managed KMS keys do not allow their policies to be modified, making cross-account access impossible with them.
2
Restrict access on the Interface VPC Endpoint.
Apply a VPC endpoint policy to the Secrets Manager interface endpoint in VPC A, restricting access to the specific database secret ARN in Account B and limiting the principal to the application's IAM role.
This prevents other IAM roles or resources in VPC A from utilizing the VPC endpoint to access other secrets or accounts.
3
Configure network-level security on the Interface VPC Endpoint.
Associate a security group with the Interface VPC Endpoint that only permits inbound HTTPS (port 443) traffic from the security group attached to the application's EC2 instances.
This ensures that only traffic originating from the authorized EC2 instances can physically reach the VPC endpoint.

Key Concept

Cross-account access to AWS Secrets Manager using Customer Managed KMS Keys and restricting access via Interface VPC Endpoint policies.
Rate this question

Topics

Strengthening Identity, Access, and Network Security