Examkin

Soru

Zorluk: OrtaSecrets and Parameters Management

A SysOps administrator is configuring cross-account access for an application running on an Amazon EC2 instance in Account A. The application must retrieve a database credential stored in AWS Secrets Manager in Account B. The secret in Account B is currently encrypted using a customer managed AWS KMS key. Which combination of actions must the administrator perform to grant the application access to the secret? (Select TWO.)

  1. Configure the resource-based policy of the secret in Account B to grant secretsmanager:GetSecretValue permissions to the IAM role of the EC2 instance in Account A.Cevap
  2. Configure the key policy of the customer managed KMS key in Account B to grant kms:Decrypt permissions to the IAM role of the EC2 instance in Account A.Cevap
  3. C
    Modify the default KMS key policy for the AWS managed key aws/secretsmanager in Account B to grant cross-account decryption access to Account A.
  4. D
    Attach an IAM policy to the EC2 instance role in Account A that grants kms:Decrypt access to the default AWS managed key in Account B.
  5. E
    Configure an IAM policy in Account A that grants the iam:PassRole permission to the AWS Secrets Manager service principal in Account B.

Cevap

Configure the resource-based policy of the secret in Account B to grant secretsmanager:GetSecretValue permissions to the IAM role of the EC2 instance in Account A, and configure the key policy of the customer managed KMS key in Account B to grant kms:Decrypt permissions to the IAM role of the EC2 instance in Account A.
To successfully set up cross-account access to a secret in AWS Secrets Manager, two key configurations are required in the owning account (Account B): first, the secret's resource policy must grant the external IAM role access to retrieve the secret value; second, the key policy of the customer managed KMS key used to encrypt the secret must grant the external IAM role decryption privileges.

Adım Adım Çözüm

1
Examine the encryption key requirements for cross-account access.
Identify that the secret must be encrypted with a customer managed KMS key rather than an AWS managed key, as AWS managed keys cannot be shared across accounts.
This establishes that permissions must be modified on a customer managed KMS key policy.
2
Configure permissions on the secret resource policy.
Modify the resource-based policy of the secret in Account B to allow the IAM role from Account A to perform the secretsmanager:GetSecretValue action.
Secrets Manager resource-based policies must explicitly grant cross-account access to external principals.
3
Configure permissions on the KMS key policy.
Modify the customer managed KMS key policy in Account B to grant kms:Decrypt permissions to the external IAM role in Account A.
IAM policies alone cannot grant access to KMS keys across accounts; the KMS key policy in the owning account must explicitly permit the decryption.

Anahtar Kavram

Cross-account access to AWS Secrets Manager secrets requires using a customer managed KMS key, configuring the resource-based policy of the secret, and configuring the key policy of the KMS key to allow decryption by the external IAM principal.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Secrets and Parameters Management

Bu konudan daha fazla soru