Question

A development team runs a containerized microservice on a managed Kubernetes cluster in a public cloud. The service needs to read objects from a cloud object storage bucket. Currently, developers have embedded a long-lived cloud access key and secret into the container image's environment variables. A security review flags this as a risk. Which approach BEST remediates the finding while following cloud IAM best practices for application identity?

Accepted Answer

Assign a workload identity (service account bound to a cloud IAM role) to the pod so the application obtains short-lived, automatically rotated credentials via the cloud provider's metadata/token service

Answer

Move the access key and secret from environment variables into a ConfigMap so they are stored outside the container image

Answer

Rotate the long-lived access key manually every 90 days and document the rotation in the change log

Answer

Encrypt the access key with a customer-managed key and decrypt it at container startup using a hardcoded passphrase