1. How should sensitive secrets be handled in CI/CD pipelines for IaC?
Secrets such as API keys and credentials should never be stored in plaintext or version control. Instead, they should be managed using secure secret vaults like HashiCorp Vault, AWS Secrets Manager, or encrypted CI/CD variables. This ensures secure automation while maintaining compliance with organizational policies.