Question

A DevOps engineer discovers that a long-lived service account key (a static JSON credential file) used by an application running on cloud VMs has been accidentally committed to a public code repository. The immediate exposure is being remediated, but leadership wants a strategy that eliminates the root cause of long-lived, exportable credentials for workloads going forward. Which approach best addresses this requirement?

Accepted Answer

Attach an identity to the VM so the workload obtains short-lived, automatically rotated tokens without any exportable key file

Answer

Rotate the service account key every 24 hours using an automated scheduled job

Answer

Encrypt the service account key file at rest and restrict repository access to authorized developers only

Answer

Store the service account key in a secrets manager and inject it into the application at runtime