A nightly batch reconciler with no human operator must call an inte…

Question

A nightly batch reconciler with no human operator must call an internal municipal fees API that expects OAuth tokens. Which approach is appropriate?

Accepted Answer

Use machine-to-machine OAuth client credentials (or IAM service identity)—not interactive user login. — Batch jobs are robots—they need client-credentials or IAM, not a human login page. Do not steal a council member’s password for the cron. Machine-to-machine auth is the right badge for a reconciler.

Answer

Hard-code a council member’s Cognito password into the batch job for nightly sign-in.

Answer

Open the fees API with no auth because the batch runs inside the VPC.

Answer

Email a one-time SMS code to an empty mailbox and paste it into CloudWatch each night.

A nightly batch reconciler with no human operator must call an internal municipal fees API that expects OAuth tokens. Which approach is appropriate?

Short Explanation

Full Explanation