Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
AWS Certified Solutions Architect - Professional · AWS
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
A: Wrong, RAM does not support KMS for resource sharing. C: You can't edit AWS managed key. D: SCP is used to deny permissions. It can't allow/grant permissions.
Although AWS supports cross-account access to Secrets Manager secrets using AssumeRole (Option B), it only works if the secret is encrypted with a customer-managed KMS key (CMK). The question specifies that the secret is encrypted with the default AWS-managed key, which cannot be shared across accounts. As confirmed by AWS’s own documentation (https://aws.amazon.com/blogs/database/design-patterns-to-access-cross-account-secrets-stored-in-aws-secrets-manager/), this requires switching to a CMK and granting cross-account kms:Decrypt access. Therefore, the correct answer is Option C, not B.
It's exactly the other way around: When using a resource-based policy, you can't use the default AWS-managed key, ergo C is not possible. But the identity-based policy from B *works* with either type of key. Ergo, answer is B.