A streaming service reads a database password for its connection pool. The platform team wants rotated passwords to take effect without a redeploy. Which approach best fits?
Show answer and explanation
Answer: D
Secret Manager stores versioned secrets, and applications can read the latest version through its API. Short-lived caching reduces request volume while letting the service pick up a rotated value without a redeploy. Baking the value into an image, setting it as a deploy-time environment variable, or storing it in a shared plain text file all freeze the value where rotation cannot update it.
Why the other options are wrong
- A. A value baked into the image is fixed at build time, so a rotated password would not reach running containers without a rebuild.
- B. Environment variables are set when the process starts and are visible in process listings, so rotation would require a restart and exposure remains.
- C. A plain text file on a shared disk is readable by anyone with access to the volume and gives no versioning or audit trail.