Last week it was observed that some of the applications were retrieving secrets from Amazon Secrets Manager which were scheduled to be deleted. These applications were not updated to use new secrets from AWS Secrets Manager. To avoid such incidents in the future, Management has asked you to create a notification when there is an attempt to access secrets pending deletion.
Which of the following steps can be used to create this notification? (Select Three)

Answer options:

A.Monitor CloudWatch for active secrets.
B.Log AWS Secrets Manager Non-API calls with AWS CloudTrail and configure CloudTrail log file delivery to CloudWatch logs.
C.Log AWS Secrets Manager API calls with AWS CloudTrail and configure CloudTrail log file delivery to CloudWatch logs.
D.Create the CloudWatch alarm to generate a notification when a Secrets Manager “ListSecretValue”API operation requests to access a version of a secret pending deletion.
E.Create the CloudWatch alarm to generate a notification when a Secrets Manager “GetSecretValue”API operation requests to access a version of a secret pending deletion.
F.Monitor CloudWatch for deleted secrets.

Correct Answers: C, E and F
A combination of AWS CloudTrail, Amazon CloudWatch Logs and Amazon SNS can be used to create an alarm that will notify any attempts to access a version of a secret pending deletion. Following steps can be configured for this,
Log AWS Secrets Manager API calls with AWS CloudTrail and Configure CloudTrail log file delivery to CloudWatch logs.
Create the CloudWatch alarm to generate a notification when a Secrets Manager “GetSecretValue”API operation requests to access a version of a secret pending deletion.
Monitor CloudWatch for deleted secrets.
Amazon SNS will notify when there is an AWS Secrets Manager API call to access secrets that are pending deletion.
Option A is incorrect as it should monitor deleted secrets and not active secrets.
Option B is incorrect as it should log API calls and not NON-API calls.
Option D is incorrect as the Secret Manager API should be “GetSecretValue” and not “ListSecretValue”.
For more information on Monitoring secrets with AWS Secrets Manager, refer to the following URL,
https://docs.aws.amazon.com/secretsmanager/latest/userguide/monitoring.html