1Z0-1067-25 Question 34
Single answerYou are deploying a new Terraform stack using Oracle Resource Manager to configure resources across multiple compartments in Oracle Cloud Infrastructure (OCI). The stack requires several sensitive input variables, including database credentials, that must remain secure. Which approach follows OCI best practices for managing these sensitive variables in a Terraform configuration?
- A
Store the sensitive credentials in a local variables.tf file that is committed to your code repository
- B
Use the OCI Vault service to securely store and retrieve sensitive variables during stack runtime
- C
Include the sensitive credentials in environment variables set within the Oracle Resource Manager console
- D
Encrypt the credentials with a custom script on your local machine and reference the encrypted strings in main.tf
Show answer and explanation
Correct answer: B
Explanation
When working with configuration management and IaC tools in OCI, the recommended practice is to store sensitive data in OCI Vault. This ensures credentials remain encrypted and are only decrypted at runtime within a tightly controlled environment. Refer to the official OCI documentation on Vault integration with Terraform or Oracle Resource Manager for detailed steps on securely retrieving secrets in your Terraform stacks.
- A. Incorrect.
Storing credentials directly in a variables.tf file and committing them to a repository poses a significant security risk. Even if the repository is private, credentials can be leaked or accessed inappropriately.
- B. Correct.
Using the OCI Vault service is considered best practice for storing and retrieving sensitive data, such as passwords and API keys. It ensures secrets are encrypted at rest, and Terraform can fetch them securely at runtime with minimal risk of exposure.
- C. Incorrect.
Although storing credentials in environment variables may be acceptable for some testing scenarios, it is not recommended for production use because these variables can be inadvertently exposed in logs or through misconfiguration.
- D. Incorrect.
Encrypting credentials with a custom script before placing them in main.tf still presents security risks and requires additional workflows to ensure decryption. It does not fully leverage OCI� secure storage mechanisms or established best practices.