SCS-C02 · Question #66
A team is using AWS Secrets Manager to store an application database password. Only a limited number of IAM principals within the account can have access to the secret. The principals who require…
The correct answer is C. Use a tag-based approach by attaching a resource policy to the secret. Apply tags to the secret. https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction_attribute-based-access- https://aws.amazon.com/blogs/security/simplify-granting-access-to-your-aws-resources-by-using- tags-on-aws-iam-users-and-roles/
Question
A team is using AWS Secrets Manager to store an application database password. Only a limited number of IAM principals within the account can have access to the secret. The principals who require access to the secret change frequently. A security engineer must create a solution that maximizes flexibility and scalability. Which solution will meet these requirements?
Options
- AUse a role-based approach by creating an IAM role with an inline permissions policy that allows
- BDeploy a VPC endpoint for Secrets Manager. Create and attach an endpoint policy that specifies
- CUse a tag-based approach by attaching a resource policy to the secret. Apply tags to the secret
- DUse a deny-by-default approach by using IAM policies to deny access to the secret explicitly.
How the community answered
(41 responses)- A12% (5)
- B5% (2)
- C80% (33)
- D2% (1)
Explanation
https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction_attribute-based-access- https://aws.amazon.com/blogs/security/simplify-granting-access-to-your-aws-resources-by-using- tags-on-aws-iam-users-and-roles/
Topics
Community Discussion
No community discussion yet for this question.