1Z0-1104-25 Question 21
Select 2You are deploying a new application on Oracle Container Engine for Kubernetes (OKE) that needs to retrieve database credentials from Oracle Cloud Infrastructure (OCI) Vault. The security requirement is that only the application pods that need these credentials should be able to access them. Which two actions should you take to securely configure this setup?
- A
Create a dynamic group that includes OKE resources, and write an IAM policy granting that group access to only the required Vault keys and secrets.
- B
Add the application pods� OCIDs as members to your main Administrators group and write a policy allowing them to manage all compartments.
- C
Use resource principal authentication in your application pods to securely connect to OCI Vault without storing long-term credentials in code.
- D
Fetch the credentials from an internal Git repository containing environment variables in plaintext that reference the Vault keys by name.
- E
Grant tenancy-level permissions to 'manage keys' for all OKE pods so they can access any key or secret in the environment.
Show answer and explanation
Correct answers: A, C
Explanation
To securely manage database credentials in OCI Vault for an OKE-based application, you must enforce least privilege using dynamic groups and tightly scoped policies. Dynamic groups let you assign permissions to OKE resources without relying on broad or static identities. Resource principal authentication is the recommended method to retrieve secrets from OCI Vault, eliminating the need to store long-term credentials. For more information, see OCI Vault service documentation and IAM Best Practices on lim iting privileges for compute resources running on OKE.
- A. Correct.
Option 1 is correct. Creating a dynamic group for the OKE resources (worker nodes or pods) and assigning a policy that grants use or read privileges only to the specific keys and secrets is a best practice. This ensures the scope of access is limited to only the needed resources.
- B. Incorrect.
Option 2 is incorrect. Adding pods� OCIDs to the tenancy� main Administrators group (or a similar broad admin group) and giving them the ability to manage all compartments violates the principle of least privilege. It exposes more resources than necessary.
- C. Correct.
Option 3 is correct. Resource principals allow workloads to authenticate directly to OCI services (like Vault) without embedding credentials, significantly reducing the risk of key compromise. This is an Oracle-recommended approach for accessing OCI services from compute resources and containers.
- D. Incorrect.
Option 4 is incorrect. Storing credentials in plaintext within a Git repository�even if referencing them by name�creates a security risk because anyone with repository access can see them. This also creates potential drift if secrets change in the Vault but are not updated in the Git repo.
- E. Incorrect.
Option 5 is incorrect. Granting tenancy-wide 'manage keys' permissions to all OKE pods circumvents the least privilege principle, allowing pods to access keys and secrets that they do not require.