Examkin

Question

Difficulty: HardSecrets and Parameters Management

A company stores an API key for a third-party billing platform in AWS Secrets Manager. To comply with security policies, the API key must be rotated automatically every 30 days. A SysOps administrator creates a custom AWS Lambda function to perform the rotation and deploys it in a private subnet of a VPC. When the administrator attempts to enable automatic rotation, the rotation fails. Which configurations are required to resolve this issue and successfully rotate the secret? (Select TWO.)

  1. Add a resource-based policy to the Lambda function that grants the lambda:InvokeFunction permission to the secretsmanager.amazonaws.com service principal.Answer
  2. Configure the route table of the Lambda function's private subnet with a route to a NAT gateway to enable outbound internet access to the billing platform.Answer
  3. C
    Attach an IAM policy to the Lambda function's execution role that grants the secretsmanager:RotateSecret permission.
  4. D
    Configure the Lambda execution role with the iam:PassRole permission to allow AWS Secrets Manager to assume the execution role during rotation.
  5. E
    Configure a VPC Gateway Endpoint for the third-party billing platform's domain and associate it with the private subnet's route table.

Answer

Grant the Secrets Manager service principal permission to invoke the Lambda function using a resource-based policy, and configure the private subnet's route table with a route to a NAT gateway to allow outbound internet access.
To successfully execute a custom rotation, the AWS Secrets Manager service principal must be granted lambda:InvokeFunction permissions on the Lambda function via a resource-based policy. Furthermore, since the Lambda function is situated in a private subnet and must reach a public third-party SaaS API endpoint to update the credentials, the subnet's route table must route internet-bound traffic through a NAT gateway located in a public subnet.

Step-by-Step Solution

1
Analyze rotation initiation requirements
Identify that AWS Secrets Manager needs permission to invoke the Lambda function, which must be configured using a Lambda resource-based policy for the service principal.
By default, Secrets Manager cannot invoke resources across services without explicit resource-based permissions.
2
Analyze network pathing for the private subnet
Identify that the Lambda function is executing inside a private VPC subnet and must reach an external SaaS billing endpoint.
Since VPC endpoints are only for AWS services or specific PrivateLink services, a route to a NAT gateway is required to reach the public internet.
3
Discard unnecessary and invalid configurations
Exclude passing roles, granting the RotateSecret permission to the Lambda execution role, or attempting to create a gateway endpoint for a third-party platform.
These actions do not align with Secrets Manager's operational model or VPC gateway routing capabilities.

Key Concept

Configuring AWS Secrets Manager custom rotation for non-AWS services requires both a Lambda resource-based policy allowing invocation by the Secrets Manager principal and a valid network routing path (such as a NAT gateway) for the VPC-bound Lambda function to reach public SaaS APIs.
Rate this question

Topics

Secrets and Parameters Management

More questions from this topic