Question

A company stores a third-party API key in AWS Secrets Manager in Account A (the security account). A Lambda function running in Account B (the workloads account) must retrieve this secret at runtime. The secret is encrypted with a customer managed KMS key in Account A. What combination of configurations is required to allow the Lambda function to read the secret?

Accepted Answer

Attach a resource-based policy to the secret granting the Account B Lambda role access, grant that role decrypt permission on the KMS key via the key policy, and give the Lambda role identity-based GetSecretValue and kms:Decrypt permissions.

Answer

Enable automatic rotation on the secret so it becomes readable across all accounts in the AWS Organization.

Answer

Copy the secret value into an environment variable of the Lambda function in Account B so no cross-account calls are needed.

Answer

Attach only an identity-based policy to the Lambda role in Account B; Secrets Manager automatically trusts any IAM principal with GetSecretValue permission across accounts.