An company is using AWS Secrets Manager to store secrets that are encrypted using a CMK and are stored in the security account 111122223333. One of the company's production accounts. 444455556666, mus

Question

Exhibits

Options

• AOption A
• BOption B
• COption C
• DOption D

• A
  81% (39)
• B
  4% (2)
• C
  4% (2)
• D
  10% (5)

Explanation

Note: The actual policy text for Options A–D wasn't included in your question - only labels were provided. The explanation below is based on the established AWS best practices this question is testing.

Option A is correct because a least-privilege resource-based policy on the secret should grant only secretsmanager:GetSecretValue to the principal arn:aws:iam::444455556666:root (the production account), allowing cross-account retrieval without exposing administrative actions like PutSecretValue, DeleteSecret, or RotateSecret. The distractors typically fail by either granting overly broad permissions (e.g., secretsmanager:*), using the wrong principal (e.g., the security account itself or a wildcard *), or specifying an IAM identity policy instead of a resource-based policy on the secret - which is required for cross-account access since IAM identity policies alone cannot grant cross-account Secrets Manager access. Remember that with a CMK-encrypted secret, you also need a corresponding KMS key policy allowing the production account to use the key, but that is a separate step from the secret policy itself.

Memory tip: Think "secret policy + key policy = cross-account access." The secret's resource policy grants GetSecretValue to the external account; the KMS key policy grants kms:Decrypt. Both must be in place - missing either one breaks the chain.

No community discussion yet for this question.