A SysOps administrator is configuring cross-region replication for an AWS Secrets Manager secret. The primary secret is stored in the us-east-1 Region, and it must be replicated to the us-west-2 Region to support a disaster recovery configuration. The secret contains database credentials that must be rotated automatically every 30 days. Which of the following actions must the administrator perform to configure this setup? (Select TWO.)
- Configure the automatic rotation schedule and rotation Lambda function on the primary secret in the us-east-1 Region.Answer
- Specify or allow Secrets Manager to create a KMS key located in the us-west-2 Region to encrypt the replica secret.Answer
- CConfigure a separate automatic rotation schedule and Lambda function on the replica secret in the us-west-2 Region.
- DUse the KMS key ARN from the us-east-1 Region to encrypt the replica secret in the us-west-2 Region.
- EAttach an IAM role with the iam:PassRole permission to the replica secret to authorize replication from the primary Region.
Answer
To configure cross-region replication for an AWS Secrets Manager secret with automatic rotation, the administrator must configure the rotation on the primary secret in the source region and ensure a regional KMS key is specified or created in the destination region for encrypting the replica secret.
To successfully configure cross-region replication with automatic rotation, the SysOps administrator must configure rotation on the primary secret in the source region. Secrets Manager will then automatically propagate the rotated values to all replica regions. Additionally, because AWS KMS keys are region-locked, a KMS key located in the destination region must be specified or created to encrypt the replicated secret.
Step-by-Step Solution
Key Concept
AWS Secrets Manager cross-region replication automatically replicates secrets to replica regions, but requires regional KMS keys for encryption, and rotation must be configured exclusively on the primary secret.