1Z0-1104-25 Question 32
Single answerYour organization has deployed a microservice on Oracle Container Engine for Kubernetes (OKE) to process customer data. The microservice needs to retrieve objects from an Object Storage bucket in the 'customer-data' compartment. You must ensure secure, temporary access without embedding credentials in the microservice code or environment variables. Which approach should you implement?
- A
Create a dedicated IAM user for the microservice and store the username/password as environment variables in the pod.
- B
Use Resource Principals by deploying the microservice as an Oracle Functions application to obtain temporary credentials automatically.
- C
Attach an API signing key to an IAM user account and embed the private key in the microservice container image.
- D
Configure a dynamic group that includes the OKE node pool and create an IAM policy granting that dynamic group read access to the 'customer-data' compartment.
Show answer and explanation
Correct answer: D
Explanation
In Oracle Cloud Infrastructure, using a dynamic group for the resources where your code runs and assigning the appropriate policies is the recommended approach for granting services temporary access to other OCI resources. This method avoids the need to store credentials in code or environment variables and leverages OCI's built-in Identity and Access Management capabilities for secure, fine-grained access control. Refer to OCI documentation on 'Dynamic Groups' and 'Policies' for detailed instructions on configuring these permissions.
- A. Incorrect.
Option 1 is incorrect. Creating a dedicated IAM user and embedding credentials in the microservice's environment variables is risky and goes against best practices for secure, temporary access. These credentials could be compromised if the environment variables are exposed.
- B. Incorrect.
Option 2 is incorrect. Resource Principals are mainly used with Oracle Functions or other serverless services. While it provides a way for a service to obtain temporary credentials, it is not the typical method for Kubernetes pods running on OKE.
- C. Incorrect.
Option 3 is incorrect. Storing a private key in the container image is insecure and can be exposed if the image is compromised or shared. It also does not provide the passwordless, transient access recommended by OCI best practices.
- D. Correct.
Option 4 is correct. Dynamic groups for OKE node pools enable you to define matching rules for compute resources in OKE. By creating an IAM policy that grants this dynamic group the necessary access (e.g., 'read objectstorage-objects in compartment customer-data'), your microservice can obtain temporary credentials automatically without storing long-term secrets.