City IAM design must separate humans who rotate Vault secrets from Functions that only fetch current contents. Which split is appropriate?
Select an answer to reveal the explanation.
Short Explanation
One team restocks the safe; another only peeks at the current combination. Manage for people who rotate; read bundles for workloads that fetch.
Full Explanation
City IAM should split secret lifecycle from secret consumption. Human users or groups that create and rotate Vault secrets need manage on secret-family (scoped to the right compartment). Dynamic groups for Functions or workload principals that only fetch current contents need read on secret-bundles (or read on the secret family at retrieval scope)—not manage. That separation lets operators rotate municipal credentials while invoke-time workloads remain read-only consumers.
Giving every Function manage secret-family while giving humans only inspect metrics inverts the model and lets workloads create or delete secrets they should only read. Giving both humans and Functions manage all-resources in the tenancy avoids some authz bugs only by destroying least privilege. Storing secrets only in Function config so neither manage nor read secret policies are required relocates the password into a weaker store and does not implement Vault governance.
Exam caveat: “read secret-family” versus “read secret-bundles” wording appears in policies and docs—bundle read is the retrieval-focused grant; do not assume inspect is enough to return plaintext. Operational check: authorize an operator to rotate a secret (manage path) and a Function dynamic group to retrieve only (read bundles); confirm the Function cannot create a new secret and the operator path is not used inside the Function image.