An Eleven-Month-Old Key and a Six-Week Deadline
An HR SaaS runs on OCI in an EU region. Dev, test and prod share a single compartment. A developer notebook containing a Generative AI API key was committed to a public repository and used to summarize salary review documents; the key belongs to a human user and has been valid for 11 months. The application runs on compute instances in a public subnet and calls the Generative AI endpoint over an internet gateway. Prompts contain employee names, salaries and performance ratings, and the team logs full request and response bodies to a local file for debugging. The security team requires: no long-lived credentials in code, private network paths for all model calls, audit evidence retained for 7 years, EU-only processing, and a defensible answer to the customer question of whether their data is used to train models. Production migration with 40,000 employees is six weeks away.
1. What is the correct order of remediation for the credential problem, and what identity model should replace the key?
Read the worked answer
Treat the committed key as compromised and revoke it first. Eleven months of validity on a human user's key means you cannot reason about who holds it, so rotation without revocation is theatre. Then remove the class of failure. Workloads on compute should authenticate with instance principals: a dynamic group matching instances by compartment or tag, plus an IAM policy granting only the generative-ai-family permissions needed in that compartment. No API keys in code, notebooks or CI variables. Where a secret is genuinely required, store it in OCI Vault and read it at runtime with a resource principal, rotating on a schedule. Split dev, test and prod into separate compartments with separate dynamic groups so a dev policy cannot reach production data. Add a pre-commit secret scanner and purge repository history, but assume the key is already public. Audit what that user was actually permitted to do, since least privilege is easier to assert once you know the blast radius.
2. Design the network, regional and audit-logging changes needed to meet the stated requirements.
Read the worked answer
Today model traffic goes from a public subnet over the internet to a public endpoint, which fails both the private-path requirement and any sensible exfiltration posture. Move compute to a private subnet, remove the internet gateway route for model traffic, and reach the Generative AI service through a private endpoint in the VCN so requests never traverse the public internet. Egress rules then permit only that endpoint, and NSGs restrict which hosts may call it. EU-only processing is achieved by pinning the model endpoint, Object Storage and any vector store to the EU region, and verifying that prompts are not shipped elsewhere for inference; if a needed feature or model is unavailable in region, change the feature, not the region. For audit, enable service logging on the GenAI calls plus VCN flow logs, deliver to Object Storage under an immutable retention policy of 7 years, and keep that archive in the EU as well, because an audit trail stored elsewhere defeats the residency claim it is meant to prove.
3. How should prompt content and logging be governed, and how should the team answer the model-training question?
Read the worked answer
Logging raw salary and performance text for debugging is the largest unresolved gap: it copies sensitive HR data into an unmanaged file and will collide with the 7-year audit archive. Separate the two purposes. The audit record needs who called what, when, with which model and which policy decision, not the salary text. Log request IDs, model, token counts, latency, caller identity, a prompt hash and classification labels; store redacted prompt bodies only where a documented business justification exists, encrypted and access-restricted. Redact before the call where possible: send employee IDs rather than names and join back in the application. On training, answer from the contract and current service documentation rather than memory: state that customer prompts and responses are not used to train the underlying models and are not shared with model providers, then support it with the actual terms, the regional configuration and the access controls in place. Verify that wording against the latest documentation before it goes into a customer response.