Examkin

Question

Difficulty: HardSecrets and Parameters Management

A SysOps administrator is configuring automatic rotation for an Amazon RDS database credential stored in AWS Secrets Manager. The secret is encrypted using a customer-managed AWS KMS key. The KMS key policy does not delegate permissions to the account's root user and lists specific IAM principals. After enabling rotation, the administrator notices that the rotation fails. The Amazon CloudWatch logs for the Lambda rotation function show an Access Denied error when attempting to retrieve the current secret version via the GetSecretValue call. The Lambda function's IAM execution role is already configured with a policy that allows secretsmanager:GetSecretValue and secretsmanager:PutSecretValue for the secret. Which of the following actions should the administrator take to resolve this issue? (Select TWO.)

  1. Add kms:Decrypt and kms:DescribeKey permissions to the IAM policy attached to the Lambda rotation function's execution role.Answer
  2. Modify the key policy of the customer-managed KMS key to grant the Lambda rotation function's execution role permissions for the kms:Decrypt and kms:DescribeKey actions.Answer
  3. C
    Add the secretsmanager:GetSecretValue and secretsmanager:DescribeSecret permissions to the customer-managed KMS key policy.
  4. D
    Attach a resource-based policy to the database secret that grants kms:Decrypt permissions to the Secrets Manager service principal.
  5. E
    Enable automatic key rotation on the customer-managed KMS key and associate it with the database secret ARN.

Answer

Add kms:Decrypt and kms:DescribeKey permissions to the IAM policy attached to the Lambda rotation function's execution role, and modify the key policy of the customer-managed KMS key to grant the Lambda rotation function's execution role permissions for the kms:Decrypt and kms:DescribeKey actions.
To resolve the Access Denied error during secret rotation, the Lambda rotation function's execution role must be granted permissions to decrypt the secret using the customer-managed KMS key. Because the KMS key is customer-managed and does not delegate permissions to the account's root user, access must be allowed in both the IAM policy attached to the Lambda execution role (granting kms:Decrypt and kms:DescribeKey) and the KMS key policy itself (granting the Lambda role principal permission to use the key). Without both, KMS policy evaluation will result in an implicit deny.

Step-by-Step Solution

1
Analyze the error context.
The Lambda rotation function receives an Access Denied error when attempting to decrypt the secret value using GetSecretValue because the secret is encrypted with a customer-managed KMS key and the function lacks decryption permissions.
Identify the cause of the failure.
2
Configure the IAM policy of the Lambda rotation function's execution role.
Add the kms:Decrypt and kms:DescribeKey permissions to the Lambda function's IAM execution role.
This grants the role permission to make KMS decrypt API calls.
3
Configure the KMS key policy.
Update the key policy to explicitly list the Lambda execution role ARN as an allowed principal for kms:Decrypt and kms:DescribeKey actions.
Since the customer-managed KMS key policy is restrictive and does not delegate permissions to the root user, updating the key policy is required to authorize the role.

Key Concept

KMS key policies have precedence and must explicitly authorize IAM roles to perform cryptographic operations if account-level delegation is not enabled.
Rate this question

Topics

Secrets and Parameters Management

More questions from this topic