Examkin

Question

Difficulty: MediumSecrets and Parameters Management

A company's security policy requires automatic rotation of database credentials stored in AWS Secrets Manager. A SysOps administrator writes a custom AWS Lambda function to perform the rotation logic. When trying to enable rotation for the database secret, the AWS Management Console displays an error indicating that the Secrets Manager service does not have permission to execute the rotation Lambda function. How should the administrator resolve this error to successfully enable rotation?

  1. A
    Assign an IAM policy to the Lambda execution role that grants permission to perform the secretsmanager:RotateSecret action
  2. Add a permission statement to the Lambda function's policy to allow the secretsmanager.amazonaws.com principal to invoke the functionAnswer
  3. C
    Update the key policy of the custom KMS key encrypting the secret to permit the Lambda function to perform kms:Decrypt operations
  4. D
    Configure the SysOps administrator's IAM policy to include the iam:PassRole permission for the Lambda function's execution role

Answer

Add a permission statement to the Lambda function's policy to allow the secretsmanager.amazonaws.com principal to invoke the function
AWS Secrets Manager requires permission to invoke the AWS Lambda rotation function. This service-to-service invocation permission must be granted via a resource-based policy on the Lambda function itself, specifying secretsmanager.amazonaws.com as the principal and lambda:InvokeFunction as the action.

Step-by-Step Solution

1
Analyze the error message showing that Secrets Manager lacks permission to execute the Lambda function.
Identify that the configuration blocker is a service-to-service invocation boundary.
Before Secrets Manager can run rotation logic, it must be authorized to call the Lambda API endpoint.
2
Determine the appropriate policy type to grant service principal invocation access to a Lambda function.
Confirm that a Lambda resource-based policy (also known as a function policy) must be used.
Resource-based policies define which principals (in this case, the secretsmanager.amazonaws.com service principal) are allowed to invoke the target resource.
3
Apply the permission using the AWS CLI or AWS Console.
Add the lambda:InvokeFunction permission with the secretsmanager.amazonaws.com principal.
This allows Secrets Manager to successfully trigger the rotation function and enables the console setup to complete.

Key Concept

Resource-based policies for AWS Lambda rotation functions in AWS Secrets Manager
Estimated Time:1m 30s
Rate this question

Topics

Secrets and Parameters Management

More questions from this topic