A team stores an application’s database password in AWS Secrets Manager. Only a limited and frequently changing set of IAM principals should be able to access the secret. A security engineer needs a solution that maximizes flexibility and scalability. Which approach meets these requirements?

The tag-based approach with aws:PrincipalTag and aws:ResourceTag condition keys offers maximum flexibility and scalability. By tagging both the secret and the IAM principals, and using a resource-based policy on the secret, you can dynamically control access without modifying IAM policies or trust policies for individual principals. When principals or access needs change, you simply update their tags, which is highly scalable for a frequently changing set of principals. The role-based approach requires updating the role's trust policy, which can become cumbersome and less scalable with frequent changes to many principals. Deploying a VPC endpoint is for network access control, not for fine-grained IAM principal authorization. The deny-by-default approach is overly complex and impractical for managing access for a frequently changing set of principals, as it involves constant additions and removals from a group.