An AMI for the parks payment listener was baked with TLS private keys in the image for "convenience." Every new instance clone now carries those keys. What is the secure fix?
Select an answer to reveal the explanation.
Short Explanation
Baking TLS private keys into an AMI is like photocopying the office master key onto every new laptop image — every clone inherits the leak. Keep images clean and pull secrets at boot from Secrets Manager or SSM instead.
Full Explanation
Secrets must not be embedded in machine images because every launched instance inherits them and AMI copies spread exposure. Retrieve TLS material at runtime from Secrets Manager or SSM Parameter Store (SecureString) with IAM least privilege. Public AMI sharing, larger volumes, or Git copies of private keys worsen the problem.