ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question
Your team is automating cloud infrastructure deployment with Terraform in a CI/CD pipeline. Static cloud-provider API keys are currently committed to the source repository. To comply with secure automated provisioning requirements, which action is most appropriate before the next release?
Create a dedicated IAM user with permanent access keys and restrict repository access to infrastructure engineers only.
Embed the keys inside Terraform modules but require peer reviews before merging into the main branch.
Commit the keys as base64-encoded variables so they are not readable in plain text.
Configure the pipeline to request temporary, short-lived cloud credentials from a trusted secrets or identity service at runtime instead of storing permanent keys.
The preferred approach is to eliminate long-lived credentials from version control and have the pipeline obtain temporary, scoped credentials at runtime. This can be achieved by configuring the build system to assume an IAM/OIDC role through AWS STS, or to request dynamically generated secrets from a service such as HashiCorp Vault or Azure Key Vault. With this model, no permanent keys are stored in code, credentials are short-lived, and automatic rotation or revocation is supported. Simply encoding secrets, restricting repository access, or relying on peer review still leaves long-term keys exposed in the repository and its history, failing to meet secure provisioning requirements.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What does runtime-generated credentials mean in the context of secure automation?
Open an interactive chat with Bash
How do temporary credentials enhance security compared to static credentials?
Open an interactive chat with Bash
What is an example of a trusted secrets or identity service used for runtime credential retrieval?
Open an interactive chat with Bash
ISC2 Certified Secure Software Lifecycle Professional (CSSLP)