A .env.production file containing live database credentials was zipped into a CodeDeploy bundle for a civic payments API. What should packaging enforce?
Select an answer to reveal the explanation.
Short Explanation
Secrets do not belong in the zip any more than spare keys belong taped to the front door. Filter .env files out of packages and pull credentials from Secrets Manager or Parameter Store at runtime. Encoding or private Git is still shipping the password.
Full Explanation
Application artifacts must not contain live credentials. Packaging filters and .gitignore/.ebignore-style exclusions should drop secret files; runtime injection from AWS Secrets Manager or SSM Parameter Store is the associate-developer pattern. Obfuscation, private remotes, or committing production env files still expose secrets in artifact stores and pipelines used by municipal teams.