A city CI pipeline needs API tokens for a 311 chatbot deploy job. Where should those secrets live?
Select an answer to reveal the explanation.
Short Explanation
Vaults are the locked evidence room—pipelines check out keys when needed, not leave them on the lobby floor of Git. Plaintext in repos or Slack is how 311 tokens walk away.
Full Explanation
A city CI pipeline that needs API tokens for a 311 chatbot deploy job should keep those secrets in a vault-backed secrets store and inject them at pipeline runtime. Vault (or equivalent secret managers) provide access control, audit trails, rotation, and short-lived delivery into the job environment without persisting tokens in source control. Municipal CI should fetch the 311 deploy credential just-in-time, use it for the deploy steps, and avoid writing it into repositories, chat, or unmanaged laptop profiles.
Committing plaintext strings in the public Git repository fails by concept: source control is replicated, cloned, and often widely readable—plaintext tokens there are disclosed by design. Posting tokens in a shared Slack channel fails confidentiality and creates unmanaged sprawl with no reliable rotation story. Hard-coding into every developer’s laptop-only shell profile fails consistency and control: CI runners will not share those profiles, and laptop secrets are hard to revoke fleet-wide.
Exam caveat: “vault-backed” includes cloud secret managers and CI-native sealed secrets patterns; the exam point is runtime injection from a controlled store, not a specific vendor logo. Masking logs still matters even with vault injection.
Operational check: store the 311 token in the vault, grant the deploy role least-privilege read, inject via the CI secret mechanism, verify the job succeeds without the token appearing in repo history or chat, rotate on a schedule, and alert on vault denials that would block chatbot deploys.