Question

A security review of a cloud-native microservices application finds that database credentials and third-party API keys are stored in plaintext within environment variables defined in the container image's Dockerfile and committed to the source code repository. The DevOps team needs a remediation approach that removes long-lived secrets from code while enabling automatic rotation and audited retrieval at runtime. Which approach best addresses these requirements?

Accepted Answer

Integrate a managed secrets management service (vault) that the application authenticates to at runtime via workload identity to fetch secrets, with rotation and access logging enabled

Answer

Move the secrets into an encrypted .env file that is decrypted by the container entrypoint script at startup using a passphrase baked into the image

Answer

Base64-encode the credentials and store them as Kubernetes ConfigMaps referenced by the deployment manifests

Answer

Restrict repository access to the DevOps team and rotate the committed credentials manually every 90 days