Developers have embedded a database password in an application's configuration file, which is committed to the source code repository. The application runs on cloud compute instances. What is the best way to supply this credential to the application?
Select an answer to reveal the explanation.
Short Explanation
A password in a config file is like taping the house key to the front door. A secrets manager keeps the key in a vault, hands it to the app only when the app proves who it is, and changes the lock on a schedule. Don't fall for answers that just move or disguise the secret; you want it out of the code entirely.
Full Explanation
A secrets manager stores credentials centrally, encrypted under keys held by a key management service, and releases them only to authenticated callers. The application authenticates with its workload identity, a platform-issued identity for the compute instance or service, so there is no bootstrap secret in code or configuration. Every retrieval is logged, access can be scoped to a single secret, and automatic rotation changes the database password on a schedule and updates the stored value. Encrypting the configuration file only moves the problem: the passphrase now lives in an environment variable on a build server, and anyone with that variable and the repository can recover the secret, while rotation remains manual. Baking the password into a container image removes it from source control but embeds it in every image layer, registry copy and cached pull, where it is easy to extract and impossible to rotate without rebuilding. Base64 is an encoding, not encryption; it is reversible by anyone, and repository access controls do not cover clones, forks or the commit history already exposed. Exam caveat: the secret already committed must be treated as compromised and rotated, even after moving to a secrets manager, because it persists in repository history. Operational check: confirm that the instance's identity can read only its own secret, that rotation succeeds without application errors, and that secret-scanning in the pipeline blocks new credentials in commits.