The vault of the cloud provider would just inject the value of the environment variable securely so it doesn't have to be stored on-disk. What the parent poster wrote isn't wrong.
replyThe parent poster is wrongly quoting me to say the original post doesn't mean “env var”. Yes, it does mean env var.
reply