Question

Difficulty: MediumSecrets and Parameters Management

A SysOps administrator is configuring cross-region replication for an AWS Secrets Manager secret. The primary secret is stored in the us-east-1 Region, and it must be replicated to the us-west-2 Region to support a disaster recovery configuration. The secret contains database credentials that must be rotated automatically every 30 days. Which of the following actions must the administrator perform to configure this setup? (Select TWO.)

  1. Configure the automatic rotation schedule and rotation Lambda function on the primary secret in the us-east-1 Region.Answer
  2. Specify or allow Secrets Manager to create a KMS key located in the us-west-2 Region to encrypt the replica secret.Answer
  3. C
    Configure a separate automatic rotation schedule and Lambda function on the replica secret in the us-west-2 Region.
  4. D
    Use the KMS key ARN from the us-east-1 Region to encrypt the replica secret in the us-west-2 Region.
  5. E
    Attach an IAM role with the iam:PassRole permission to the replica secret to authorize replication from the primary Region.

Answer

To configure cross-region replication for an AWS Secrets Manager secret with automatic rotation, the administrator must configure the rotation on the primary secret in the source region and ensure a regional KMS key is specified or created in the destination region for encrypting the replica secret.
To successfully configure cross-region replication with automatic rotation, the SysOps administrator must configure rotation on the primary secret in the source region. Secrets Manager will then automatically propagate the rotated values to all replica regions. Additionally, because AWS KMS keys are region-locked, a KMS key located in the destination region must be specified or created to encrypt the replicated secret.

Step-by-Step Solution

1
Identify the primary source secret and target replica Region.
Confirming primary secret is in us-east-1 and target is us-west-2.
Determines where resources and policies must be created.
2
Configure automatic rotation on the primary secret.
Automatic rotation runs in the primary Region and updates are automatically replicated.
Secrets Manager replica secrets are read-only and do not support independent rotation configurations.
3
Specify or create an AWS KMS key in the target replica Region.
A KMS key in us-west-2 is mapped to encrypt the replica secret.
AWS KMS keys are region-bound and cannot be shared across different AWS Regions.

Key Concept

AWS Secrets Manager cross-region replication automatically replicates secrets to replica regions, but requires regional KMS keys for encryption, and rotation must be configured exclusively on the primary secret.
Rate this question