SCS-C02 Question 394
Select 4A company is using AWS Secrets Manager to securely store and manage their application credentials. The security team has recently discovered that some secrets were accidentally exposed due to improper permissions on the Secrets Manager secrets. How can the team design and implement controls to ensure secrets are protected and only accessible to authorized users or services?
- A
Use AWS Identity and Access Management (IAM) policies to explicitly define which users or roles can access specific secrets.
- B
Enable rotation of secrets using AWS Secrets Manager to automatically update stored credentials on a schedule.
- C
Disable encryption for secrets stored in AWS Secrets Manager to improve performance.
- D
Implement resource-based policies on Secrets Manager secrets to restrict access to specific AWS accounts or IAM principals.
- E
Set up AWS CloudTrail to monitor and log access requests to secrets stored in AWS Secrets Manager.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To protect credentials, secrets, and cryptographic key materials, it is essential to implement multiple layers of security, including IAM policies, resource-based policies, secret rotation, and monitoring via AWS CloudTrail. These measures ensure that access to secrets is restricted to authorized entities, credentials are periodically updated to reduce exposure risk, and any unauthorized access attempts are logged and can be investigated. Disabling encryption for performance reasons is a security anti-pattern and should be avoided.
- A. Correct.
Correct: Using IAM policies allows you to enforce least privilege access, ensuring that only authorized users or roles can access specific secrets.
- B. Correct.
Correct: Enabling secret rotation reduces the risk of unauthorized access by ensuring that credentials are updated regularly and automatically.
- C. Incorrect.
Incorrect: Disabling encryption compromises the security of stored secrets, making them vulnerable to unauthorized access and breaches.
- D. Correct.
Correct: Resource-based policies provide granular access control by allowing you to restrict access to secrets based on specific AWS accounts or IAM principals.
- E. Correct.
Correct: AWS CloudTrail provides logging and monitoring of access requests, enabling the detection of unauthorized or suspicious access attempts.