AWS Certified Security - Specialty SCS-C02 — Topic 1 Question 29

Question

A team is using AWS Secrets Manager to store an application database password. Only a limited number of IAM principals within the account can have access to the secret. The principals who require access to the secret change frequently. A security engineer must create a solution that maximizes flexibility and scalability. Which solution will meet these requirements?

Accepted Answer

Correct answer: C. The correct answer is C. Option C: Use a tag-based approach by attaching a resource policy to the secret. Apply tags to the secret and the IAM principals. Use the aws:PrincipalTag and aws:ResourceTag IAM condition keys to control access. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

AWS Certified Security - Specialty SCS-C02 — Question 29