SOA-C02 Question 219
Select 2A company is using AWS Secrets Manager to store database credentials for an application. The security team has identified a risk that some secrets have been exposed due to overly permissive IAM policies. To mitigate this, they want to ensure that only the application’s EC2 instances can access the secrets. Which combination of actions will address this requirement?
- A
Attach a resource-based policy to the secret that restricts access to the specific EC2 instances based on their tags.
- B
Use an IAM role attached to the EC2 instances, and grant the role permissions to access the secret in Secrets Manager.
- C
Enable Secrets Manager rotation to automatically rotate the secret and mitigate the exposure.
- D
Apply a VPC endpoint policy to restrict access to Secrets Manager only through the private network.
- E
Use Systems Manager Parameter Store instead of Secrets Manager, as it provides more secure access control.
Show answer and explanation
Correct answers: B, D
Explanation
To ensure that only the application’s EC2 instances can access the secrets, an IAM role should be attached to the instances, granting them the necessary permissions to access Secrets Manager. Additionally, a VPC endpoint policy can be applied to restrict access to Secrets Manager only through the private network, further enhancing security. Together, these measures address the identified risk of exposure due to overly permissive IAM policies.
- A. Incorrect.
Resource-based policies in AWS Secrets Manager do not support directly specifying EC2 instance tags for restrictions. Instead, IAM roles and policies should be used for such access control.
- B. Correct.
Using an IAM role attached to the EC2 instances is the recommended way to grant access to AWS resources (including Secrets Manager) securely. The role can be configured with least privilege access.
- C. Incorrect.
While enabling rotation is a good practice to mitigate future exposure of secrets, it does not restrict access to the secret, which is the primary concern in this scenario.
- D. Correct.
Applying a VPC endpoint policy ensures that access to Secrets Manager is restricted to the private network, which adds an additional layer of security and aligns with the requirement to limit access.
- E. Incorrect.
Systems Manager Parameter Store is another service for managing secrets, but switching to it does not inherently solve the issue of overly permissive IAM policies. The problem needs to be addressed in the current setup.