Apex Games keeps production secrets (database passwords and API tokens) in a dedicated security account’s AWS Secrets Manager. Due to policy, workloads in other AWS accounts cannot assume cross-account roles. The workloads must read these secrets directly at runtime. What is the MOST secure way to enable this?

The most secure way to enable direct secret access without cross-account role assumption is to use resource-based policies on the secrets themselves. This allows granular GetSecretValue permissions for specific IAM roles in consumer accounts. Additionally, the KMS key policy or grants must be updated to permit these roles to decrypt the secret's Customer Managed Key (CMK), as Secrets Manager encrypts secrets at rest. This method adheres to the "no cross-account role assumption" policy while maintaining least privilege. Cross-account secret replication is not a native Secrets Manager feature. Moving secrets to Parameter Store and sharing via RAM would require a migration and might not be suitable if Secrets Manager-specific features are needed. Interface VPC endpoints provide private connectivity but do not grant access permissions; policies are still required.