How should an application running in the cloud get credentials to call other cloud services? Why avoid long-lived access keys?
What they are really testing: Whether you reach for roles and short-lived credentials instead of static keys. Hard-coded long-lived keys are one of the most common real-world breaches.
A real interview question
How should an application running in the cloud get credentials to call other cloud services? Why avoid long-lived access keys?
What most people say
drag me
“I would create an IAM user, generate access keys, and put them in the application config.”
This is the exact anti-pattern. A static key in config is the classic leak vector, it does not expire and is painful to rotate. The expected answer is roles with temporary credentials.
The follow-ups they ask next
Your CI pipeline needs to deploy to the cloud. How does it authenticate without a stored key?
OIDC federation: the CI provider issues a signed identity token, the cloud trusts that issuer and lets the job assume a scoped role for a short-lived credential. No long-lived secret in the CI settings.
What is the difference between an IAM user and an IAM role?
A user is a long-lived identity with its own credentials (for a human). A role is assumed to get temporary credentials (for a service, instance, or cross-account access), nothing permanent attached.
What the interviewer is listening for
- Rejects static keys outright
- Knows instance profiles/IRSA/managed identity
- Mentions OIDC for CI and least privilege
What sinks the answer
- Stores access keys in config
- No notion of temporary credentials
- Cannot distinguish a user from a role
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“Never [hard-code a long-lived access key, it leaks and never expires]. Attach [a role to the workload: instance profile, IRSA/workload identity, managed identity] so the platform [injects short-lived auto-rotating credentials]. Scope it to [least privilege], and for CI use [OIDC federation to assume a role] instead of a stored key.”
Keep going with security
Foundation
Explain the shared responsibility model. Where does the cloud provider's job end and yours begin?
Foundation
What is the CIA triad, and why is it a useful way to think about security?
Foundation
What is the difference between authentication and authorization?
Junior
What is the difference between encryption at rest and in transit, and why do you need both?
Junior
What is the difference between symmetric and asymmetric encryption, and where is each used?
Mid
What does it mean to "shift security left", and how would you build security into a CI/CD pipeline?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free