Explain how you would secure sensitive information (like API keys) in your deployment process.

Question

Accepted Answer

Securing sensitive information in a deployment pipeline means never storing secrets like API keys in code or plain configuration, and instead injecting them at runtime through environment variables or a dedicated secret manager.

Key Points:
• Use secret management tools such as HashiCorp Vault, AWS Secrets Manager, or Kubernetes Secrets to store and retrieve credentials securely.
• Avoid hardcoding secrets in source files, application.properties, or Dockerfiles, since anything committed to Git effectively lives forever in history.
• CI/CD tools like Jenkins have built-in credential stores that inject secrets into the pipeline environment without exposing them in logs or job configuration.
• Restrict access to secrets using role-based access control so only authorized services and people can retrieve them.
• Encrypt secrets both at rest and in transit, and rotate credentials periodically to limit the impact of any leak.

Example:
Instead of putting a payment gateway API key in application.properties, the team stores it in AWS Secrets Manager and the application fetches it at startup using IAM permissions scoped to that one secret.

Code Example:
```
pipeline {
    stages {
        stage('Deploy') {
            steps {
                withCredentials([string(credentialsId: 'payment-api-key', variable: 'API_KEY')]) {
                    sh 'deploy.sh --api-key=$API_KEY'
                }
            }
        }
    }
}
```

Interview Tip:
A concise interview answer is:

"I keep secrets out of code entirely and rely on a secret manager like Vault or AWS Secrets Manager, or Kubernetes Secrets, with access locked down by role. In Jenkins, I use its credential store so keys are injected at build time without ever appearing in logs or source control."