Question

A company stores a database credential in AWS Secrets Manager in a central security account. Applications running in a separate workload account (within the same AWS Organization) must retrieve this secret at runtime. The secret is encrypted with a customer managed KMS key in the security account. When the workload account's application role calls GetSecretValue, it receives an AccessDenied error, even though the role has been granted secretsmanager:GetSecretValue and kms:Decrypt in its identity-based policy. What is required to allow cross-account access to succeed?

Accepted Answer

Attach a resource policy to the secret granting access to the workload account's role, and update the KMS key policy to allow the workload role to perform kms:Decrypt.

Answer

Enable automatic rotation on the secret so that a new version becomes available to the workload account.

Answer

Replicate the secret to the workload account using Secrets Manager multi-Region replication and reference the local replica.

Answer

Add an SCP in the workload account's OU that explicitly allows secretsmanager:GetSecretValue on the central secret.