Move secrets out of environment variables and prove the leak

applied · 70 min · Objective 4.5

Task

Environment variables are better than hard-coding and are not safe. Show the leak paths concretely, then implement run-time retrieval by workload identity and confirm the same paths are clean.

Steps

  1. Run a container with the fake credential set as an environment variable. From outside the container, find it in the process environment and in the container's inspect output. Record both commands and outputs in lab/secrets.md.
  2. Make the application crash and confirm whether the value appears in the crash output or the logs. Record the result either way.
  3. Switch to a mounted secret FILE with restrictive permissions. Repeat the three checks above and record which are now clean.
  4. Switch again to run-time retrieval: the container fetches the value from the local secret store using an identity attached to it, holding nothing in its environment or filesystem. Repeat the checks.
  5. Write the ranking of the three approaches with the leak paths each one closes, and the rotation rule for a credential that has been exposed.

Verify

grep -c 'NOT-A-REAL-CREDENTIAL' lab/secrets.md
grep -Eci 'inspect|environ' lab/secrets.md
grep -Eci 'mounted file|mount' lab/secrets.md
grep -Eci 'rotat' lab/secrets.md

The fake string must appear in the early findings and the notes must record it absent after the final approach. The rotation rule matters: a leaked secret is rotated, not deleted, because you must assume it was copied.

This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.