SCS-C02 Question 401
Select 3Your organization uses AWS Secrets Manager to securely store database credentials for multiple environments (development, staging, and production). A security audit revealed that credentials for the production database were accidentally exposed due to improper access control settings. As the security engineer, you need to ensure that only the appropriate IAM roles or users can access the production secrets. Which steps should you take to restrict access to the production database secret while maintaining security best practices?
- A
Use resource-based policies in Secrets Manager to explicitly allow access only to specific IAM roles or users.
- B
Enable automatic rotation for the production database secret to generate a new set of credentials.
- C
Attach an AWS KMS key policy to the encryption key used for the secret, allowing only specific IAM roles or users to decrypt the secret.
- D
Use AWS Organizations Service Control Policies (SCPs) to block access to Secrets Manager for all other accounts.
- E
Create an IAM policy with least privilege permissions and attach it to the appropriate IAM roles or users.
Show answer and explanation
Correct answers: A, B, E
Explanation
To properly secure a secret in AWS Secrets Manager, it is critical to use multiple layers of security. Resource-based policies explicitly restrict access to specific IAM identities, IAM policies enforce least privilege permissions, and automatic rotation ensures that exposed credentials are regularly replaced. KMS key policies and SCPs are useful in broader security contexts but do not directly manage access to individual secrets in Secrets Manager.
- A. Correct.
This is correct. Resource-based policies in Secrets Manager allow you to control access to specific secrets. By explicitly granting access to specific IAM roles or users, you can ensure that only authorized identities can interact with the production secret.
- B. Correct.
This is correct. Enabling automatic rotation ensures that if credentials are exposed, they will be rotated to a new set of credentials, mitigating risk. This is a critical security best practice for managing secrets.
- C. Incorrect.
This is incorrect. While KMS key policies are important for controlling access to the encryption key, they do not directly restrict access to the secret itself. Secrets Manager uses AWS KMS only for encryption and decryption of the secret's data.
- D. Incorrect.
This is incorrect. AWS Organizations SCPs are used to set permission boundaries for AWS accounts within an organization. While they can limit access to Secrets Manager service at an account level, they are not granular enough to manage access to specific secrets.
- E. Correct.
This is correct. Creating and attaching an IAM policy with least privilege permissions ensures that only the necessary roles or users have the ability to access the production database secret, following security best practices.