MLA-C01 Question 340
Select 3You are working as a Machine Learning Engineer for a team deploying a model on AWS SageMaker. Your team uses Git for version control to collaborate on the model's training scripts, configuration files, and dataset preprocessing code. During a code review, you notice that a teammate has committed sensitive AWS access keys into the repository. What should you do to address this issue and prevent it from happening in the future?
- A
Use the Git command
git rm --cachedto remove the sensitive keys and push the changes to overwrite the commit history. - B
Revoke the exposed AWS access keys immediately and generate new ones.
- C
Use a Git pre-commit hook to prevent sensitive information like access keys from being committed in the future.
- D
Enable a secret scanning tool or service, such as AWS Secrets Manager or GitHub Advanced Security, to detect sensitive information in commits.
- E
Encrypt the sensitive keys using AWS Key Management Service (KMS) and recommit them to the repository.
Show answer and explanation
Correct answers: B, C, D
Explanation
When sensitive AWS access keys are committed to a Git repository, it creates a significant security risk because those keys could be used to access AWS resources maliciously. Revoking the keys immediately (Option 2) is necessary to mitigate the risk and prevent unauthorized access. Additionally, proactive measures like using Git pre-commit hooks (Option 3) and enabling secret scanning tools (Option 4) ensure that such sensitive information is not committed to the repository in the future. Option 1 does not fully address the issue as it leaves the keys in the Git history, and Option 5 is not a best practice because sensitive information should not be stored in version control even if encrypted.
- A. Incorrect.
Using the
git rm --cachedcommand removes the sensitive file from the staging area but does not remove it from the commit history, which means the keys would still be accessible in previous commits. This is not a complete solution. - B. Correct.
Revoking the exposed AWS access keys and generating new ones is critical to prevent unauthorized access to AWS resources. This is a necessary step to mitigate the security risk caused by the leak.
- C. Correct.
A Git pre-commit hook can be configured to check for patterns like AWS access keys and prevent them from being committed in the first place. This is a proactive way to avoid similar issues in the future.
- D. Correct.
Enabling secret scanning tools or services like AWS Secrets Manager or GitHub Advanced Security adds an additional layer of security by continuously monitoring the repository for sensitive information.
- E. Incorrect.
Encrypting the keys with AWS KMS and recommitting them to the repository is not recommended because sensitive keys should not be stored in version control at all, even if encrypted.