A township accidentally committed AWS access keys to a public Git repository. Which remediation architecture best removes the reliance on long-lived keys for compute while containing the leak?
Select an answer to reveal the explanation.
Short Explanation
Leaked keys are like leaving the city vault combination on a bulletin board—first change the combination, then stop writing it down. Disable and rotate what leaked, stash any remaining secrets in Secrets Manager, and let compute assume IAM roles instead of carrying static keys. More IAM users or baking keys into images just spreads the same problem.
Full Explanation
After a township accidentally commits AWS access keys to a public Git repository, the sound remediation architecture disables and rotates the leaked keys immediately, moves any remaining secrets into AWS Secrets Manager (or equivalent secured stores) where applications still need them, and prefers IAM roles for EC2, Lambda, and other compute so workloads receive temporary credentials instead of standing access keys. That sequence both contains the leak and removes the architectural habit that caused it—embedding long-lived keys where roles should have been used.
Creating additional IAM users that reuse the same leaked keys fails because it expands the number of principals sharing a compromised secret and does nothing to invalidate what is already public. Leaving the keys active while only alarming when the public repo is forked fails because detection of forks is not containment; attackers who already scraped the commit can use the keys without forking anything. Embedding replacement access keys in every container image and rebuilding nightly fails conceptually because it continues the long-lived-key anti-pattern and places secrets in immutable layers that are hard to rotate and easy to extract.
Exam caveat: rotation without CloudTrail review can miss whether the leaked keys were already used for persistence (new users, backdoor roles, or data exfiltration). Operational check: disable/delete the exposed keys, search CloudTrail for their use, inventory images and CI variables for other static credentials, attach instance/task/execution roles for compute, and require Secrets Manager retrieval with least-privilege IAM for any remaining secret material.