A citizen-portal Function needs a database password at run time. Where should that secret live?
Select an answer to reveal the explanation.
Short Explanation
Passwords are not souvenirs for the repo or the image. Vault holds them; the app fetches the current value when it runs.
Full Explanation
A citizen-portal Function’s database password should live in OCI Vault, with the application retrieving current secret contents at run time. Vault centralizes rotation, IAM-controlled access, and audit of secret reads. Credentials must not be baked into Function source, container images, OCIR layers, or “hidden” Function configuration values that travel with the deployment artifact. Run-time retrieval keeps the secret out of git history and image scans while allowing version updates without redeploying hardcoded strings.
Hard-coding the password in the Function source repository next to the handler fails by concept: source control becomes a secret store and every clone is a leak. Storing the password in a Dockerfile ENV layer committed to OCIR as the permanent store fails because image registries and layer history retain the secret. Placing the password in a public Object Storage object because bucket encryption-at-rest “is enough” fails confidentiality: encryption at rest does not replace access control, and public readability defeats the purpose of a database credential.
Exam caveat: Vault (or equivalent secret service) at run time—not repo, image, or public bucket. Operational check: grant the Function’s dynamic group or resource principal read on the Vault secret, remove plaintext passwords from config and code, invoke the Function, and confirm it retrieves the current secret version successfully while a principal without IAM access cannot.