Examkin

Question

Difficulty: Very hardSecrets and Parameters Management

An organization implements a multi-account structure where database credentials are centralized in a security account (Account B) using AWS Secrets Manager. A microservice running on an Amazon EC2 instance in a production account (Account A) requires access to one of these secrets. The secret is encrypted using the default AWS managed key `aws/secretsmanager`. The SysOps administrator configures a resource-based policy on the secret in Account B to allow the EC2 instance's IAM role in Account A to call `secretsmanager:GetSecretValue`. The IAM role in Account A has also been granted permissions to call `secretsmanager:GetSecretValue` on the secret's ARN. However, the EC2 instance receives an `AccessDeniedException` when attempting to retrieve the credential.

Which configuration adjustment will resolve this access issue?

  1. A
    Modify the key policy of the default AWS managed key `aws/secretsmanager` in Account B to grant `kms:Decrypt` permissions to the IAM role in Account A.
  2. B
    Add `iam:PassRole` permissions to the EC2 instance's IAM role in Account A, and configure the EC2 instance to assume the default Secrets Manager service-linked role in Account B.
  3. Re-encrypt the secret in Account B using a customer managed KMS key, grant the IAM role in Account A permission to perform `kms:Decrypt` in its IAM policy, and update the customer managed KMS key policy in Account B to allow `kms:Decrypt` for the IAM role in Account A.Answer
  4. D
    Configure a gateway VPC endpoint for Secrets Manager in Account A, and associate the endpoint with the route tables of the subnets where the EC2 instances are running.

Answer

Re-encrypt the secret in Account B using a customer managed KMS key, grant the IAM role in Account A permission to perform `kms:Decrypt` in its IAM policy, and update the customer managed KMS key policy in Account B to allow `kms:Decrypt` for the IAM role in Account A.
To enable cross-account access to an AWS Secrets Manager secret, the secret must be encrypted with a customer managed KMS key (CMK). The default AWS managed KMS key (`aws/secretsmanager`) has an immutable key policy that cannot be altered to grant cross-account permissions. Once a customer managed KMS key is selected, three permissions must align: the resource policy on the secret in Account B must allow read access; the customer managed key policy in Account B must explicitly permit `kms:Decrypt` for the external identity; and the IAM policy of the role in Account A must permit both secret retrieval and key decryption.

Step-by-Step Solution

1
Analyze the encryption key used for the secret.
The secret is encrypted using the default AWS managed key `aws/secretsmanager`.
Default AWS managed KMS keys cannot be used for cross-account access because their key policies are managed by AWS and are immutable.
2
Re-encrypt the secret in the source account (Account B).
The secret is now encrypted using a customer managed KMS key (CMK).
Customer managed KMS keys support policy modifications, which are required to delegate cross-account access.
3
Modify the customer managed KMS key policy in Account B.
The key policy allows the IAM role in Account A to execute the `kms:Decrypt` action.
Cross-account access to KMS keys requires the key policy to explicitly delegate access to the external account or its roles.
4
Configure the IAM identity policy in Account A.
The EC2 instance's IAM role includes permissions to call `kms:Decrypt` on the KMS key in Account B.
To access resources in another account, the requesting identity's IAM policy must also explicitly allow the necessary actions on the external resource.

Key Concept

Cross-account access to AWS Secrets Manager secrets requires using a customer managed KMS key (CMK). The default AWS managed KMS key policy is immutable and cannot be configured to allow cross-account decryption. Access must be granted on both the Secrets Manager resource policy, the KMS key policy, and the caller's IAM policy.
Estimated Time:3m 0s
Rate this question

Topics

Secrets and Parameters Management

More questions from this topic