A parks department scripts that call AWS from a workstation accidentally committed IAM access keys into a public GitHub repository. What should the city treat as the core lesson about those keys?
Select an answer to reveal the explanation.
Short Explanation
Think of access keys like a spare house key taped under a doormat — once it's on the internet, anyone can use it. Those keys let scripts talk to AWS without the console, so treat them as secrets: store them safely, rotate them, and never paste them into public repos.
Full Explanation
IAM access keys are long-lived credentials for programmatic access via the CLI, SDKs, or APIs. Public exposure enables unauthorized API calls until the keys are deactivated and rotated. Cloud Practitioner guidance emphasizes protecting and rotating access keys and avoiding embedding them in source control; prefer roles and temporary credentials when possible.