DOP-C02 · Question #153
A company uses AWS Secrets Manager to store a set of sensitive API keys that an AWS Lambda function uses. When the Lambda function is invoked the Lambda function retrieves the API keys and makes an…
The correct answer is B. Create a KMS customer managed key that trusts Secrets Manager and allows the Lambda D. Ensure that the Lambda function's execution role has the KMS permissions scoped on the. To ensure only the Lambda function's execution role can access a Secrets Manager secret, the DevOps engineer must create a KMS customer managed key (CMK) with a key policy that trusts Secrets Manager and grants kms:Decrypt permissions to the Lambda role. Subsequently, the…
Question
A company uses AWS Secrets Manager to store a set of sensitive API keys that an AWS Lambda function uses. When the Lambda function is invoked the Lambda function retrieves the API keys and makes an API call to an external service. The Secrets Manager secret is encrypted with the default AWS Key Management Service (AWS KMS) key. A DevOps engineer needs to update the infrastructure to ensure that only the Lambda function's execution role can access the values in Secrets Manager. The solution must apply the principle of least privilege. Which combination of steps will meet these requirements? (Choose two.)
Options
- AUpdate the default KMS key for Secrets Manager to allow only the Lambda function's execution
- BCreate a KMS customer managed key that trusts Secrets Manager and allows the Lambda
- CCreate a KMS customer managed key that trusts Secrets Manager and allows the account's root
- DEnsure that the Lambda function's execution role has the KMS permissions scoped on the
- ERemove all KMS permissions from the Lambda function's execution role
How the community answered
(53 responses)- A28% (15)
- B49% (26)
- C17% (9)
- E6% (3)
Why each option
To ensure only the Lambda function's execution role can access a Secrets Manager secret, the DevOps engineer must create a KMS customer managed key (CMK) with a key policy that trusts Secrets Manager and grants `kms:Decrypt` permissions to the Lambda role. Subsequently, the Lambda function's execution role requires IAM permissions scoped to both the specific CMK and the Secrets Manager secret.
Default AWS managed KMS keys have immutable key policies that cannot be modified by customers to restrict access to specific IAM principals, making this approach unfeasible.
A customer managed key (CMK) allows for a customizable key policy, which is essential to explicitly grant the necessary `kms:Decrypt` permissions to the Lambda function's execution role and allow Secrets Manager to use the key for encryption and decryption on its behalf, adhering to least privilege.
Allowing the account's root user to use the KMS key provides overly broad access and violates the principle of least privilege, which specifically aims to restrict access to only the necessary Lambda role.
The Lambda function's execution role must be explicitly granted `secretsmanager:GetSecretValue` permission on the specific secret and `kms:Decrypt` permission on the specific customer managed key used for encryption. Scoping these permissions precisely ensures the principle of least privilege is applied.
Removing all KMS permissions from the Lambda function's execution role would prevent the function from decrypting the secret, thus making it unable to retrieve its value and blocking the intended workflow.
Concept tested: KMS key policy and IAM permissions for Secrets Manager access
Source: https://docs.aws.amazon.com/secretsmanager/latest/userguide/create-custom-kms.html
Topics
Community Discussion
No community discussion yet for this question.