Which solution will meet these requirements?

By:
In: SAP-C02
Tagged:
With: 1 Comment
A company uses AWS Organizations for a multi-account setup in the AWS Cloud.The company uses AWS Control Tower for governance and uses AWS Transit Gateway for VPC connectivity across accounts.In an AWS application account, the company’s application team has deployed a web application that uses AWS Lambda and Amazon RDS.The company’s database administrators have a separate DBA account and use the account to centrally manage all the databases across the organization.The database administrators use an Amazon EC2 instance that is deployed in the DBA account to access an RDS database that is deployed m the application account.The application team has stored the database credentials as secrets in AWS Secrets Manager in the application account.The application team is manually sharing the secrets with the database administrators.The secrets are encrypted by the default AWS managed key for Secrets Manager in the application account.A solutions architect needs to implement a solution that gives the database administrators access to the database and eliminates the need to manually share the secrets.

Which solution will meet these requirements?

Use AWS Resource Access Manager (AWS RAM) to share the secrets from the application account with the DBA account. In the DBA account, create an IAM role that is named DBA-Admin. Grant the role the required permissions to access the shared secrets. Attach the DBA-Admin role to the EC2 instance for access to the cross-account secrets.

In the application account, create an IAM role that is named DBA-Secret. Grant the role the required permissions to access the secrets. In the DBA account, create an IAM role that is named DBA-Admin. Grant the DBA-Admin role the required permissions to assume the DBA-Secret role in the application account. Attach the DBA-Admin role to the EC2 instance for access to the cross-account secrets

In the DBA account create an IAM role that is named DBA-Admin. Grant the role the required permissions to access the secrets and the default AWS managed key in the application account. In the application account, attach resource-based policies to the key to allow access from the DBA account. Attach the DBA-Admin role to the EC2 instance for access to the cross-account secrets.

In the DBA account, create an IAM role that is named DBA-Admin. Grant the role the required permissions to access the secrets in the application account. Attach an SCP to the application account to allow access to the secrets from the DBA account. Attach the DBA-Admin role to the EC2 instance for access to the cross-account secrets.

Explanations:

AWS RAM is not designed to share AWS Secrets Manager secrets across accounts. IAM roles and policies would be used instead for cross-account access to Secrets Manager.

This option allows the DBA-Admin role in the DBA account to assume the DBA-Secret role in the application account. It grants proper permissions to access the cross-account secrets securely using IAM roles.

Resource-based policies for an AWS managed key cannot be used to grant cross-account access to Secrets Manager. IAM roles and policies are the proper method for cross-account access to secrets.

SCPs are used to control permissions at the account level and do not grant specific resource-level access. SCPs alone would not be effective for granting cross-account access to secrets in AWS Secrets Manager.

2025-10-21

1 Comment

  1. Willie
    Author

    I opine that the answer is:
    In the application account, create an IAM role that is named DBA-Secret. Grant the role the required permissions to access the secrets. In the DBA account, create an IAM role that is named DBA-Admin. Grant the DBA-Admin role the required permissions to assume the DBA-Secret role in the application account. Attach the DBA-Admin role to the EC2 instance for access to the cross-account secrets

Leave a Reply

Your email address will not be published. Required fields are marked *

four × one =