A microservice runs in private subnets and must read exactly one AWS Secrets Manager secret using its IAM task role: arn:aws:secretsmanager:us-east-1:111122223333:secret:prod/db-pass-AbCdEf Security requires that every Secrets Manager API call comes only through a specific Interface VPC Endpoint (vpce-0a1b2c3d4e5f6g7h), and must not be reachable over any other network path. Which IAM policy change best enforces this requirement?

Add a condition that allows secretsmanager:GetSecretValue only when aws:SourceIp is within 10.0.0.0/8.

Source IP conditions cannot reliably prove that the traffic used the required Interface VPC endpoint. Requests can be translated by NAT gateways, proxies, or load balancers, and the observed Source IP may not uniquely identify the endpoint path.

Require TLS by adding a condition on aws:SecureTransport for the Secrets Manager permission.

aws:SecureTransport enforces that the request uses HTTPS, but it does not restrict which network path was used to reach Secrets Manager. A call could still reach the public endpoint over an unintended route while using TLS.

Add a KMS condition using kms:ViaService=secretsmanager.us-east-1.amazonaws.com instead of restricting Secrets Manager directly.

The kms:ViaService condition affects whether a key can be used via a particular AWS service context, but the question’s requirement is about the network path to the Secrets Manager API. This does not constrain the request to originate from the specified Interface VPC endpoint.

What does this SAA-C03 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: In the task role policy statement for secretsmanager:GetSecretValue on the secret ARN, add a condition that allows the action only when aws:SourceVpce equals vpce-0a1b2c3d4e5f6g7h. — The requirement is specifically about the origin network path. For Interface VPC endpoints, aws:SourceVpce can be used in the IAM policy condition so that secretsmanager:GetSecretValue is authorized only when the Secrets Manager request is made through the approved endpoint vpce-0a1b2c3d4e5f6g7h. Because the permission is conditioned on the endpoint identity, access is denied for calls that reach Secrets Manager through any other path (even if those calls use HTTPS). B is not endpoint-specific and can be affected by NAT/proxy/source IP translation, so it cannot guarantee the request used the required Interface VPC endpoint. C addresses encryption in transit but not endpoint/network path. D is about KMS key usage context, not about authorizing Secrets Manager API calls based on the VPC endpoint through which they arrive.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.