A .env.production file containing live database credentials was zipped into a CodeDeploy bundle for a civic payments API. What should packaging enforce?
Select an answer to reveal the explanation.
Short Explanation
Secrets do not belong in the zip any more than spare keys belong taped to the front door. Filter .env files out of packages and pull credentials from Secrets Manager or Parameter Store at runtime. Encoding or private Git is still shipping the password.
Full Explanation
Packaging must exclude secrets from deployable artifacts. A .env.production file containing live database credentials zipped into a CodeDeploy bundle for a civic payments API should be removed from the bundle; inject credentials at deploy or runtime from Secrets Manager or Parameter Store instead. Municipal payment packaging that ships live passwords inside zips turns every artifact copy, artifact bucket object, and pipeline cache into an unintended secret store that auditors will flag.
Keeping secrets in the bundle but restricting Git remotes to private networks only fails because the zip itself still carries credentials wherever CodeDeploy and S3 store revisions. Base64-encoding the .env file inside the zip so scanners cannot read it fails conceptually—encoding is not encryption and operators can decode it trivially. Committing .env.production to the main branch for auditability of live passwords fails by maximizing version-control exposure under the guise of audit.
Exam caveat: exclude files in both packaging specs and CI workspace scrubbing; a forgotten second copy under scripts/ or config/ still ships. Operational check: scan the CodeDeploy revision for .env and credential patterns, confirm runtime retrieval from Secrets Manager or SSM, and rotate any credentials that were previously bundled.