Examkin

Question

Difficulty: HardSecrets and Parameters Management

An organization runs a containerized microservice on Amazon ECS in Account B (111122223333111122223333). The application must retrieve database credentials stored in AWS Secrets Manager in Account A (444455556666444455556666). The secret in Account A is encrypted using a customer managed KMS key.

The SysOps administrator has configured the secret's resource policy in Account A to allow the ECS task execution role in Account B to perform `secretsmanager:GetSecretValue`. In Account B, the administrator attached an IAM policy to the ECS task execution role allowing `secretsmanager:GetSecretValue` on the secret ARN and `kms:Decrypt` on the KMS key ARN in Account A.

During container startup, the task fails with an `AccessDeniedException` indicating that the ECS container agent is unauthorized to perform `kms:Decrypt` on the customer managed KMS key.

Which action should the administrator take to resolve this issue?

  1. A
    Add the `iam:PassRole` permission to the ECS task execution role in Account B targeting the AWS Secrets Manager service role in Account A.
  2. B
    Change the encryption of the secret in Account A to use the default AWS managed key (`aws/secretsmanager`) to automatically delegate decryption authority to Account B.
  3. Add a statement to the key policy of the customer managed KMS key in Account A that allows the ECS task execution role in Account B to perform the `kms:Decrypt` action.Answer
  4. D
    Deploy a VPC endpoint for AWS Secrets Manager in Account B's VPC, and ensure the endpoint's route table includes a route pointing to the VPC peering connection with Account A.

Answer

Add a statement to the key policy of the customer managed KMS key in Account A that allows the ECS task execution role in Account B to perform the `kms:Decrypt` action.
For cross-account access where an IAM role in Account B needs to retrieve a secret encrypted with a customer managed KMS key in Account A, both resource policies in Account A must permit the access. The secret's resource policy must permit the role to call `secretsmanager:GetSecretValue`, and the KMS key policy must permit the role to call `kms:Decrypt`. Because the KMS key is in a different account, IAM policies in Account B alone cannot grant the permission without the source key policy delegating authority.

Step-by-Step Solution

1
Analyze the authorization chain for cross-account encrypted secret retrieval.
Identify that the ECS task execution role in Account B requires both Secrets Manager permissions on the secret and KMS Decrypt permissions on the customer managed key.
When a secret is encrypted with a KMS customer managed key, the decryption permission is evaluated separately from the secret read permission.
2
Evaluate why the identity-based policy in Account B is insufficient on its own.
Recognize that identity policies in one account cannot grant access to KMS resources in another account unless the KMS key policy in the source account delegates that authority.
AWS Key Management Service key policies must explicitly trust external accounts or specific external roles for cross-account cryptographic operations.
3
Formulate the correct policy modification.
Determine that updating the customer managed KMS key policy in Account A to trust the ECS task execution role in Account B with `kms:Decrypt` resolves the authorization issue.
This establishes the necessary trust relationship, allowing the ECS container agent to decrypt the secret payload during container startup.

Key Concept

Cross-account AWS KMS key access for Secrets Manager encryption keys
Estimated Time:2m 30s
Rate this question

Topics

Secrets and Parameters Management

More questions from this topic