A contractor committed long-term AWS access keys for a city recreation app into a public Git repository. What should the team do first for application access going forward?
Select an answer to reveal the explanation.
Short Explanation
Treat leaked keys like a lost master key to City Hall—change the locks now. Disable or rotate, clean the repo, and move the app onto roles with temporary credentials. Publishing the keys elsewhere or turning them into Cognito passwords makes the mess worse.
Full Explanation
When access keys are exposed, teams must deactivate or rotate them promptly and remove secrets from source control. Applications should prefer IAM roles and temporary credentials rather than long-term keys in git. Leaving keys active or redistributing them increases compromise risk. Cognito user passwords are unrelated to AWS access-key remediation.