Examkin

Question

Difficulty: Very hardSecrets and Parameters Management

A SysOps administrator is configuring automatic rotation for a database secret in AWS Secrets Manager. The database is an Amazon RDS PostgreSQL instance running in a private subnet. The secret is encrypted with a customer-managed KMS key. The administrator creates a rotation Lambda function in the same VPC and associates it with the secret. During testing, the rotation fails. CloudWatch Logs for the Lambda function show that `GetSecretValue` calls return a `DecryptionException`. The Lambda function's execution role has an IAM policy attached that allows `kms:Decrypt` and `kms:DescribeKey` on the database secret's KMS key ARN.

Which of the following is the most likely cause of this error?

  1. A
    The Secrets Manager service principal (`secretsmanager.amazonaws.com`) has not been granted permission to assume the Lambda function's execution role in the role's trust policy.
  2. B
    The VPC route table associated with the Lambda function's subnet does not contain a route to the AWS KMS Gateway Endpoint, preventing the decryption request from reaching the service.
  3. The key policy of the customer-managed KMS key does not grant access to the Lambda execution role and lacks a statement allowing IAM policies to govern access to the key.Answer
  4. D
    The IAM policy attached to the Lambda execution role lacks the `iam:PassRole` permission for the AWS KMS service role, preventing the key from being passed to the Secrets Manager service.

Answer

The key policy of the customer-managed KMS key does not grant access to the Lambda execution role and lacks a statement allowing IAM policies to govern access to the key.
The correct answer is correct because AWS KMS requires that the key policy explicitly allow access to the key, or delegate administration to the account's IAM policies (often done by permitting the root principal). If the key policy does not permit the root user or the specific Lambda execution role, any IAM policies granting access to the key will be ignored, resulting in a DecryptionException when Secrets Manager attempts to decrypt the secret using the Lambda execution role.

Step-by-Step Solution

1
Analyze the error location and details.
The CloudWatch Logs show a DecryptionException generated within the Lambda function execution. This implies the Lambda function was successfully invoked and executed, eliminating invocation and trust policy issues.
We must verify whether the failure occurs at the invocation stage or during the execution of the API calls inside the function.
2
Evaluate network connectivity to AWS KMS.
The error is a DecryptionException (authorization issue) rather than a socket timeout, ruling out VPC security group, route table, or endpoint routing issues.
Network isolation issues prevent reaching the service entirely, whereas authorization issues return a structured API error response.
3
Check Key Policy vs. IAM Policy hierarchy.
In AWS KMS, key policies are the primary authorization mechanism. Without a statement allowing the root principal (delegating control to IAM) or explicitly naming the Lambda execution role, IAM policies granting KMS permissions will be ignored.
KMS key policies take precedence over IAM policies; IAM policies alone cannot grant access to a customer-managed KMS key unless the key policy delegates authority to IAM.

Key Concept

AWS KMS Key Policy Precedence and Secrets Manager Rotation
Rate this question

Topics

Secrets and Parameters Management

More questions from this topic