An application moving to containers currently embeds database credentials in its deployment archive. What should the modernization include?

1. Bake the same permanent credentials into the public container image.
2. Put the secret in a resource Name tag.
3. Replace the password with the account root access key.
4. Move secrets to a managed secret store and use workload-scoped temporary identity for retrieval.