A township accidentally committed AWS access keys to a public Git repository. Which remediation architecture best removes the reliance on long-lived keys for compute while containing the leak?
Select an answer to reveal the explanation.
Short Explanation
Leaked keys are like leaving the city vault combination on a bulletin board—first change the combination, then stop writing it down. Disable and rotate what leaked, stash any remaining secrets in Secrets Manager, and let compute assume IAM roles instead of carrying static keys. More IAM users or baking keys into images just spreads the same problem.
Full Explanation
When access keys are exposed, the immediate controls are to deactivate or delete them, rotate related credentials, and review CloudTrail for misuse. Longer term, workloads should obtain temporary credentials through IAM roles for EC2, Lambda, ECS tasks, and similar compute rather than embedding long-lived keys. Secrets Manager (or SSM SecureString parameters) centralizes any remaining secrets with rotation. Creating more users that share the same keys, ignoring the leak, or baking keys into images increases blast radius instead of eliminating static credentials.