Question

A company stores database credentials in AWS Secrets Manager in a central security account (Account A). An application running on EC2 instances in a separate workload account (Account B) must retrieve these credentials at runtime. The secret is encrypted with a customer managed KMS key in Account A. As the SysOps administrator, what must you configure to allow the application to securely retrieve the secret?

Accepted Answer

Attach a resource-based policy to the secret granting the Account B IAM role secretsmanager:GetSecretValue, add the Account B role as a grantee in the KMS key policy for kms:Decrypt, and grant the role permissions in Account B.

Answer

Enable automatic rotation on the secret and share the rotation Lambda function with Account B so the application can invoke it.

Answer

Copy the secret into Account B using Secrets Manager replication and disable the KMS key in Account A.

Answer

Add the Account B account ID to the AWS managed key (aws/secretsmanager) key policy and attach an identity policy in Account B only.