Question

A company stores database credentials in AWS Secrets Manager in a central security account (Account A). Application workloads running in a separate workload account (Account B) must retrieve these credentials at runtime. The security team requires that the secret be encrypted with a customer managed KMS key and that credentials automatically rotate every 30 days. After configuring cross-account IAM roles in Account B, the applications receive an AccessDeniedException when calling GetSecretValue. What combination of configurations is required to resolve the access issue while meeting the requirements?

Accepted Answer

Attach a resource-based policy to the secret in Account A granting the Account B role secretsmanager:GetSecretValue, and add a key policy statement on the customer managed KMS key granting the Account B role kms:Decrypt.

Answer

Enable automatic rotation on the secret and add the Account B role as a principal in the rotation Lambda's execution role so it inherits decrypt permissions.

Answer

Replace the customer managed KMS key with the AWS managed aws/secretsmanager key, since customer managed keys cannot be shared across accounts.

Answer

Add secretsmanager:GetSecretValue to the Account B role's identity policy only; cross-account secret access does not require a resource policy when IAM roles are configured.