During review of a licensing Oracle Function, a database password is found in Function application config and duplicated as an ENV in the image. What should replace both?
Select an answer to reveal the explanation.
Short Explanation
Function config and image layers are the wrong pockets for a password—anyone who can pull or read config can see them. Put the secret in Vault and fetch it with a principal.
Full Explanation
Function application and function config are for non-secret key-value settings. Image layers are readable to anyone who can pull the image. Tokens, private keys, and database passwords belong in Vault and should be retrieved with a principal. A private OCIR repository does not make a baked-in password acceptable.