Examkin

Soru

Zorluk: ZorSecrets and Parameters Management

A SysOps administrator is configuring automatic rotation for a database credential stored as a secret in AWS Secrets Manager. The database is an Amazon Aurora PostgreSQL DB cluster running in a private VPC subnet. The secret is encrypted using a customer managed AWS KMS key. The administrator configures a custom AWS Lambda function to handle the rotation, deploying it within the same VPC. During testing, the rotation fails, and the CloudWatch Logs for the Lambda rotation function indicate that it is unable to decrypt the current database credential to perform the login test. Which two actions should the SysOps administrator take to resolve this issue? (Select TWO.)

  1. Add a statement to the KMS key policy of the customer managed key that allows the Lambda rotation function's execution role to perform kms:Decrypt and kms:GenerateDataKey operations.Cevap
  2. Attach an IAM policy to the Lambda rotation function's execution role that grants permissions to perform secretsmanager:GetSecretValue, secretsmanager:DescribeSecret, and secretsmanager:PutSecretValue on the secret.Cevap
  3. C
    Update the database's security group to allow inbound traffic from the AWS Secrets Manager service endpoint IP addresses on the database port.
  4. D
    Grant the iam:PassRole permission to the Lambda execution role for the Secrets Manager service principal.
  5. E
    Add a statement to the IAM policy of the Secrets Manager service-linked role that grants access to perform kms:Decrypt on the KMS key.

Cevap

To resolve the rotation issue, the administrator must add a statement to the KMS key policy of the customer managed key to allow the Lambda rotation function's execution role to perform decrypt and key generation operations, and attach an IAM policy to the Lambda rotation function's execution role that grants permission to retrieve and modify the secret.
The custom Lambda rotation function requires standard Secrets Manager API permissions (GetSecretValue, DescribeSecret, and PutSecretValue) to interact with the secret metadata and stages. Furthermore, because the secret is encrypted with a customer managed KMS key, the key policy must explicitly authorize the Lambda rotation function's execution role to use the key for decryption and key generation.

Adım Adım Çözüm

1
Analyze the decryption failure in the custom Lambda rotation logs.
Determine that the Lambda function's execution role lacks permissions to use the customer managed KMS key to decrypt the secret.
Since a customer managed KMS key is used, access must be delegated to the Lambda execution role in both IAM and the KMS key policy.
2
Modify the KMS key policy.
Add a statement to the KMS key policy of the customer managed key that allows the Lambda rotation function's execution role to perform kms:Decrypt and kms:GenerateDataKey operations.
This enables the Lambda function to decrypt the encrypted secret value retrieved from Secrets Manager.
3
Update the Lambda execution role IAM policy.
Ensure the role has policies granting secretsmanager:GetSecretValue, secretsmanager:DescribeSecret, and secretsmanager:PutSecretValue on the secret.
The rotation Lambda needs these API permissions to read the current password stage and submit the updated password back to Secrets Manager.

Anahtar Kavram

AWS Secrets Manager automated rotation permissions and KMS key policy integration.
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

Secrets and Parameters Management

Bu konudan daha fazla soru