A harbor-pilot runbook asks for “the password of the VM’s managed identity” so it can be stored next to other secrets. How should the security engineer respond?
Select an answer to reveal the explanation.
Short Explanation
There’s no password to photocopy—managed identities don’t hand you one. Tell the runbook writers to use RBAC (or a proper app with federation), not a sticky-note secret.
Full Explanation
Managed identities eliminate credential management: Azure issues tokens for the identity, and operators cannot export a password. Access is granted by assigning Azure roles (or, where an app registration is required, by using certificates or workload identity federation—not by inventing a managed-identity password). Requests to retrieve or rotate such a password misunderstand the control and should be refused.