A city development team committed API keys into a public GitOps repository used for a citizen-services app. Leadership wants a redesign so configuration secrets are not stored in source control. Which solution best remediates that risk?
Select an answer to reveal the explanation.
Short Explanation
Leaving keys in a public GitOps repo is like taping the building master key to the front door. Secrets Manager (or SecureString parameters) holds the real key, and the app role picks it up at runtime—no secrets living in git.
Full Explanation
Application configuration and credentials security requires removing long-lived secrets from repositories. AWS Secrets Manager or SSM Parameter Store SecureString stores encrypted secrets and allows runtime retrieval via an instance, task, or execution role. Encoding in git or duplicating public copies does not remediate exposure. Runtime injection with least-privilege IAM is the Associate-level pattern.