Question

A financial services company is migrating a monolithic on-premises application to a hybrid architecture. The application authenticates to a downstream payment API using a static API key stored in a configuration file that has not been rotated in three years. Security architects want to eliminate long-lived static credentials while minimizing changes to the legacy application code, which cannot easily support modern SDKs. Which approach BEST addresses the requirement?

Accepted Answer

Deploy a sidecar proxy that obtains short-lived tokens from the identity provider and injects them into outbound API calls, transparently to the legacy application

Answer

Store the existing static API key in a centralized secrets manager and configure the application to retrieve it at startup

Answer

Rotate the static API key manually every 90 days and document the rotation in the change management system

Answer

Embed the API key in an encrypted environment variable protected by the host operating system's key store