Untitled Lesson
Skill Matrix
UNLOCK NODES BY LEARNING NEW TAGS.
You discover a database password was accidentally committed to a public git repository three days ago. What is the correct FIRST remediation step?
💻 Code Challenge | +75 XP
Write a getDbConnection() function that catches an authentication error, re-fetches the current secret from a mock secrets manager, and retries the connection once before throwing.
A rotated database credential caused a brief production outage because the running service kept using its old, now-invalid cached password. Reorder the steps to build a rotation-safe connection strategy.
Task: Reorder the blocks in logical sequence to solve the problem.
A.D.A. Interface
Adaptive Didactic Assistant
Pascual Vila
Frontend Instructor // Code Syllabus
The Error //
Treating "delete the committed secret from the latest commit" as sufficient remediation for a leak
// Insufficient alone:
// git rm .env && git commit -m "remove secret"
// Required first:
// Rotate the actual credential at its source (DB, API provider, etc.)The Solution //
Removing a file from the current commit does nothing to the secret's presence in git history — anyone with clone access (or who cloned before the fix) can still retrieve it via git log -p or a similar history search. The only real fix is rotating the secret at its source immediately; history cleanup is a secondary, less urgent step afterward.
The Error //
Granting a service broad access to every secret in the secrets manager instead of scoping to what it actually needs
// Wrong: this service can read ALL production secrets
"Resource": "arn:aws:secretsmanager:*:*:secret:prod/*"
// Correct: scoped to only this service's own secrets
"Resource": "arn:aws:secretsmanager:*:*:secret:prod/email-service/*"The Solution //
Overly broad IAM permissions mean that if any single service is ever compromised (via a dependency vulnerability, for instance), the blast radius extends to every secret that service could access — not just the ones it legitimately uses. Scope each service's secrets-manager IAM policy to only the specific secret paths it needs.