A microservice reads a secret from AWS Secrets Manager using its task role (ServiceRole). The secret is configured to use a customer-managed CMK. In production, the service fails with AccessDeniedException on GetSecretValue. CloudTrail shows that Secrets Manager attempted kms:Decrypt but was denied. Which IAM policy change is most appropriate to fix the failure while keeping least privilege?

Add secretsmanager:ListSecrets permission on "*" so the service can discover the secret and retry the read.

ListSecrets addresses discovery, not decryption. The CloudTrail evidence indicates kms:Decrypt was denied, so this would not resolve the root cause.

Add s3:GetObject permission to ServiceRole for the KMS key alias stored in an S3 bucket.

Secrets Manager uses KMS for cryptographic operations; it does not require S3 GetObject permissions for the CMK. This is unrelated to the reported kms:Decrypt denial.

Add kms:Encrypt permission instead of kms:Decrypt, because the service only needs to read the secret.

Encrypt is the opposite operation. Reading a Secrets Manager value requires decrypting the stored ciphertext, so kms:Decrypt is the correct missing permission.

What does this SAA-C03 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Add kms:Decrypt permission for the specific CMK ARN to ServiceRole, and also keep secretsmanager:GetSecretValue for the specific secret ARN. — Because the CloudTrail entry shows Secrets Manager attempted kms:Decrypt and was denied, the task role must have KMS permissions to allow decryption using the specific CMK that protects the secret. The least-privilege fix is to grant kms:Decrypt on the CMK ARN used by that secret and ensure secretsmanager:GetSecretValue is scoped to only the required secret ARN. This allows Secrets Manager to decrypt the secret value while avoiding broad permissions like ListSecrets or wildcard KMS access. Option B adds discovery permissions but does not address the kms:Decrypt denial, so the service would still fail to decrypt. Option C is unrelated to Secrets Manager’s decryption path and does not correspond to the CloudTrail evidence. Option D grants kms:Encrypt, which cannot decrypt stored ciphertext; reads will continue to fail. Only A targets the exact missing kms:Decrypt permission on the relevant CMK.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.