Examkin

Question

Difficulty: MediumSecrets and Parameters Management

A SysOps administrator has configured automatic rotation for a database secret in AWS Secrets Manager. The secret stores credentials for an Amazon RDS for PostgreSQL DB instance that is located in a private subnet. During testing, the automatic rotation fails, and the administrator observes that the credentials are not being updated on the database. Which of the following configuration changes should the SysOps administrator make to resolve this failure? (Select TWO.)

  1. Configure the Lambda rotation function to run within the VPC with access to the private subnets where the database is located.Answer
  2. Grant permission to the Secrets Manager service principal to invoke the Lambda function using a Lambda resource policy.Answer
  3. C
    Add an inbound rule to the database security group that allows traffic from the Secrets Manager service endpoint.
  4. D
    Edit the key policy of the default AWS managed KMS key (aws/secretsmanager) to grant decryption rights to the Lambda execution role.
  5. E
    Apply an IAM policy to the Lambda execution role that contains the iam:PassRole permission for the Secrets Manager service role.

Answer

To resolve the automatic rotation failure for the private database secret, the administrator must configure the Lambda rotation function to run inside the VPC with access to the private subnets, and grant the Secrets Manager service principal permission to invoke the Lambda function via a Lambda resource policy.
The correct actions are configuring the Lambda rotation function to run within the VPC and granting the Secrets Manager service principal permission to invoke the Lambda function. Because the database is private, the Lambda function must have network access via the VPC. Additionally, Secrets Manager requires permission to invoke the Lambda function, which is configured on the Lambda resource policy.

Step-by-Step Solution

1
Analyze network connectivity requirements between the rotation Lambda function and the private Amazon RDS database.
The Lambda function needs to be configured with the appropriate VPC, subnets, and security groups to establish a network path to the database.
Since the database is in a private subnet, the Lambda function must also reside in the VPC to reach it.
2
Review the service permissions required for AWS Secrets Manager to trigger the rotation process.
Identify that the Lambda function's resource policy must allow lambda:InvokeFunction from the secretsmanager.amazonaws.com principal.
Without this policy, Secrets Manager cannot invoke the Lambda function to execute rotation.
3
Verify and rule out incorrect options involving default KMS key policy modifications and PassRole requirements.
Default AWS managed KMS key policies cannot be changed, and iam:PassRole is not used for Secrets Manager rotation invocation.
Ensures that administrative actions align with AWS security bounds and permission models.

Key Concept

AWS Secrets Manager database credential rotation in a VPC requires proper network path configuration and Lambda invocation permissions.
Rate this question

Topics

Secrets and Parameters Management

More questions from this topic