Question

A security team discovers that a production application stores static database credentials in an environment variable that has not changed in over two years. Compliance requires that database credentials be rotated every 30 days without application downtime, and the application must always retrieve valid credentials at runtime. Which approach best meets these requirements?

Accepted Answer

Store the credentials in a managed secrets manager configured for automatic rotation, and have the application retrieve the current secret at runtime via an API call or SDK.

Answer

Encrypt the environment variable with a customer-managed key and re-deploy the application every 30 days with new credentials.

Answer

Move the credentials into an encrypted configuration file baked into the container image and rebuild the image monthly.

Answer

Write a cron job that emails the new credentials to the operations team each month so they can manually update the environment variable.