Allow the Kubernetes service account's assumed IAM role in the KMS key policy to use the key
A company uses an Amazon Elastic Kubernetes Service (Amazon EKS) cluster to deploy its web applications on containers. The web applications contain confidential data that cannot be decrypted without specific credentials. A DevOps engineer has stored the credentials in AWS Secrets Manager. The secrets are encrypted by an AWS Key Management Service (AWS KMS) customer managed key. A Kubernetes service account for a third-party tool makes the secrets available to the applications. The service account assumes an IAM role that the company created to access the secrets. The service account receives an Access Denied (403 Forbidden) error while trying to retrieve the secrets from Secrets Manager. What is the root cause of this issue?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
For a KMS customer managed key, the key policy must name the principals permitted to use the key, and the principal that actually makes the decrypt call is the IAM role the Kubernetes service account assumes, not the EKS cluster role (B). trungtd identified exactly this, noting that C is wrong because it names the EKS cluster IAM role rather than the role the service account assumes. Option D is nonsensical because a role does not need permission to access an EKS cluster in order to read a secret, and option A describes the role that already has the Secrets Manager permissions.
The service account assumes an IAM role to reach Secrets Manager, and the secrets are encrypted with a customer managed KMS key. A key policy that does not grant that role permission to use the key blocks the decryption, producing the 403 Forbidden even though the role has Secrets Manager access. The root cause is the key policy omitting the service account's assumed role, so adding that role to the key policy resolves it.
Allowing the EKS cluster IAM role in the key policy (C) — the cluster role is not the principal making the Secrets Manager call; the service account assumes its own IAM role, and only that role's session appears in the request, so granting the cluster role does not authorize the decryption. Adding an EKS cluster role permission to access the cluster in the role (D) — the requirement has nothing to do with cluster access; the service account already reaches Secrets Manager. Failing to allow the assumed role (A) — the role does have Secrets Manager access already, which is why the failure is not at that layer.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Access to a secret encrypted with a customer managed KMS key requires both Secrets Manager permissions on the calling principal and permission to use the key, and for a customer managed key that second requirement is enforced by the key policy. The principal that makes the decrypt request here is the IAM role that the Kubernetes service account assumes, because that is the identity whose session is used to call Secrets Manager. Since the error is a 403 Forbidden, the Secrets Manager layer is evidently working and the failure is at the key, so the root cause is that the customer managed key's policy does not allow that service-account IAM role to use the key, and adding the role to the key policy resolves it (B). B is the correct answer.Why the Other Options Are Wrong
A states that the IAM role attached to the EKS cluster does not have access to retrieve the secrets. The scenario already establishes that the service account assumes an IAM role created by the company to access the secrets, so the Secrets Manager permission layer is in place; a failure there would not be specific to this configuration. C states that the key policy does not allow the EKS cluster IAM role to use the key. Although naming a principal in a key policy is the right shape of fix, the EKS cluster IAM role is the wrong principal: it is the role the service account assumes that issues the Secrets Manager request, so the key policy must name that assumed role; trungtd made precisely this observation when rejecting C. D states that the assumed role does not have permission to access the EKS cluster, which is irrelevant, since the requirement concerns reading a secret from Secrets Manager and the service account already authenticates to the cluster. B is correct.Community Comment Notes
Community voted B unanimously. jamesf explained that when a Kubernetes service account in Amazon EKS accesses Secrets Manager it does so by assuming an IAM role, so the required permissions comprise both the Secrets Manager permissions on that role and the key policy allowing the role to use the key. trungtd explicitly identified why C is wrong, noting that it is the IAM role assumed by the Kubernetes service account rather than the EKS cluster IAM role that appears in the request. tgv and jojewi8143 confirmed B. No alternative received support.Official Reference
Related Analysis
Practice All DOP-C02 Questions
Access 85 questions with complete answers and detailed explanations.
View Full DOP-C02 Practice Test →