A community tandem-club helper currently has an access key pasted into a laptop script. Which change removes that long-lived secret from the file?
Select an answer to reveal the explanation.
Short Explanation
Think of an access key pasted into a laptop script. Swap it for an IAM role the compute assumes. A stolen file should not be a permanent credential.
Full Explanation
The community tandem-club helper currently embeds an access key in a laptop script. The correct change is to replace that static key with an IAM role the compute assumes, so a stolen file is not a permanent credential. Roles issue short-lived credentials through the instance, container, or local profile chain. Rotating or disabling access no longer depends on chasing every copy of a pasted secret.
Keeping the static key and sharing the file more widely fails because wider distribution multiplies leak risk and leaves a long-lived secret in many places. Pasting the key into the prompt fails because prompts are logged, cached, and often visible to callers—turning a secret into content. Storing the key in a dashboard title fails because chart labels are not a secrets manager and are typically broadly visible.
Exam caveat: switching to a role still requires least-privilege policies on that role; a powerful assumed role is only slightly better than a powerful static key. Operational check: delete the embedded key, confirm the helper assumes a role via the compute identity, verify CloudTrail or credential reports no longer show the old long-lived key in use, and rotate/disable the old access key immediately.