Examkin

Question

Difficulty: MediumSecrets and Parameters Management

A company is using a multi-account AWS architecture. A SysOps administrator is configuring an application running on an Amazon EC2 instance in Account A (account ID 111111111111111111111111) that must retrieve a database connection string. The connection string is stored as a SecureString parameter named `/prod/db/connection_string` in AWS Systems Manager Parameter Store in Account B (account ID 222222222222222222222222). The parameter is encrypted with a customer managed AWS KMS key in Account B. Which configuration will allow the application in Account A to retrieve the parameter value?

  1. Configure the application to assume an IAM role in Account B that has permissions to perform ssm:GetParameter on the parameter and kms:Decrypt on the KMS key. Grant the EC2 instance profile in Account A permissions to assume this role.Answer
  2. B
    Configure a resource-based policy on the Parameter Store parameter in Account B to allow Account A's IAM role to perform ssm:GetParameter, and add Account A's IAM role to the KMS key policy in Account B with kms:Decrypt permissions.
  3. C
    Share the Parameter Store parameter with Account A using AWS Resource Access Manager (RAM). Update the KMS key policy in Account B to grant kms:Decrypt permissions to the EC2 instance profile role in Account A.
  4. D
    Configure the IAM role of the EC2 instance in Account A with permissions to perform ssm:GetParameter directly on the parameter ARN in Account B, and grant it kms:Decrypt permissions on the KMS key in Account B.

Answer

Configure the application to assume an IAM role in the destination account that has permissions to retrieve the parameter and decrypt it using the customer managed KMS key, while granting the EC2 instance profile in the source account permissions to assume this role.
Systems Manager Parameter Store does not support resource-based policies. To access a parameter across AWS accounts, the application must assume an IAM role in the target account (Account B) that has the required permission policies (ssm:GetParameter and kms:Decrypt). The source account's IAM role must have permission to perform sts:AssumeRole on the target role.

Step-by-Step Solution

1
Determine if AWS Systems Manager Parameter Store supports resource-based policies.
It does not support resource-based policies, meaning cross-account sharing cannot be done directly at the resource level.
This determines that cross-account access must be handled via IAM role assumption.
2
Configure an IAM role in Account B with the necessary access permissions.
An IAM role is created in Account B with a trust policy allowing Account A to assume it, and permissions to execute ssm:GetParameter and kms:Decrypt on the parameter and KMS key respectively.
The role must have permission to access both the encrypted parameter and the KMS key used for its decryption.
3
Configure the EC2 instance profile in Account A.
The instance profile role in Account A is granted sts:AssumeRole permissions targeting the IAM role in Account B.
This allows the application on the EC2 instance to assume the role in Account B and retrieve the secret.

Key Concept

Cross-account access to Systems Manager Parameter Store parameters using IAM role assumption
Estimated Time:1m 30s
Rate this question

Topics

Secrets and Parameters Management

More questions from this topic