A CodeBuild stage and a BYOC container still embed a database password for a permit-desk feature lookup. Where should that credential live?
Select an answer to reveal the explanation.
Short Explanation
A CodeBuild stage and a BYOC container still embed a database password. Put it in Secrets Manager and retrieve it at run time with IAM. Plaintext in the image, env vars, or the repo is the anti-pattern.
Full Explanation
AWS Secrets Manager is the in-scope store for pipeline and endpoint credentials, retrieved with IAM. Plaintext in images, environment variables, or the repo is the anti-pattern. Polly is not a secret store, and a public gist is worse than embedding the password.