SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  secretsmanager:ListSecrets on all secrets (resource set to "*")

  Why it's wrong here

  ListSecrets only returns metadata such as secret names, ARNs, and description fields, not the actual secret values. Setting Resource to '*' would permit the role to enumerate every secret in the account, which violates least privilege and creates a broad reconnaissance surface for any compromise. Because the Lambda already knows the exact secret it must read, listing secrets is entirely unnecessary for the scenario.

  When this WOULD be correct

  If the Lambda function needed to discover which secrets exist (e.g., to dynamically select one based on naming pattern) before reading its value, then secretsmanager:ListSecrets on all secrets would be appropriate.

• ✓

  secretsmanager:GetSecretValue on only the secret’s full ARN

  Why this is correct

  GetSecretValue is the only AWS Secrets Manager API action that returns the encrypted secret's decrypted string, which is exactly what the Lambda function must read. By restricting the Action to secretsmanager:GetSecretValue and the Resource to the secret's full ARN, the IAM policy grants access to that single secret while denying all other Secrets Manager operations. This follows least privilege because the function cannot update, list, or describe any other secret, and the full ARN is more precise than using a wildcard or partial name.

• ✗

  secretsmanager:UpdateSecret on the specific secret ARN

  Why it's wrong here

  UpdateSecret is a write operation that modifies the secret's value or rotates it, but performing an update does not return the current secret value to the caller. Even when scoped to the specific secret ARN, this action grants unnecessary write access; if the Lambda role is compromised, an attacker could maliciously change the secret and potentially disrupt downstream applications. A read-only role should never include UpdateSecret because it expands the blast radius beyond the functional need.

  When this WOULD be correct

  A Lambda function that needs to rotate a secret (e.g., update a database password) after reading it would require secretsmanager:UpdateSecret on the specific secret ARN to write the new value.

• ✗

  secretsmanager:DescribeSecret on all secrets (resource set to "*")

  Why it's wrong here

  DescribeSecret is a metadata-only call that returns details such as the secret's ARN, name, description, rotation configuration, and last-changed dates, but it never exposes the secret's value. Specifying '*' for the resource expands the permission to every secret in the account without providing any benefit, since the function already has the secret's full ARN. This permission is therefore both insufficient and overly broad—it cannot satisfy the read requirement and it grants far more access than needed.

  When this WOULD be correct

  A question that asks for listing metadata of all secrets (e.g., to check rotation status) and least privilege is not a concern, or the requirement is to retrieve metadata for any secret in the account.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question