A CI build role must push an image to Amazon ECR without access keys in the Jenkinsfile. How should programmatic access be configured?
Select an answer to reveal the explanation.
Short Explanation
CI shouldn’t carry permanent keys in the pipeline file. Let Jenkins (or GitHub Actions) federate with OIDC, assume a push role, and use short-lived credentials to talk to ECR.
Full Explanation
Programmatic access for machines should use IAM roles and modern federation (OIDC) to obtain temporary credentials, avoiding static keys in source control. Embedding access keys, public unauthenticated pushes, or root credentials are insecure anti-patterns.