A water-utility Oracle Function must read a Vault secret at runtime without embedding an IAM user key. Which approach follows the documented Functions path?
Select an answer to reveal the explanation.
Short Explanation
The Function becomes a named worker badge via a dynamic group; policy lets that badge read the secret; resource principal is how the badge signs the API call—no user PEM in the image.
Full Explanation
The documented Functions path for reading Vault without shipping an IAM user key is: match the water-utility Function into a dynamic group, grant that dynamic group read on the secret family or a named secret, and retrieve with the OCI SDK resource-principal signer. The platform injects resource-principal credentials at runtime; the Function never embeds a user PEM. That combination gives least-privilege, rotatable access tied to the Function resource rather than to a human identity baked into the image.
Baking a tenancy admin PEM into the OCIR image and exporting it as a config key named like a password conflates identity material with the secret itself and creates a catastrophic leak surface in every image pull and config read. Storing the password in application config while granting manage all-resources in the tenancy both places the secret in the wrong store and grants far more privilege than retrieval needs. Fetching the password from a public Object Storage object anonymously over the internet abandons confidentiality entirely and is never an acceptable substitute for Vault.
Exam caveat: dynamic-group matching for Functions uses resource.type = 'fnfunc' (optionally narrowed by compartment, OCID, or defined tag); a correct policy on the wrong principal still fails at runtime. Operational check: confirm the Function’s OCID matches the dynamic group, verify the policy grants read (not only inspect) on the intended secret scope, invoke once, and confirm retrieval succeeds without any user key files present in the image or config.