A CI/CD pipeline can deploy code to production. That makes it production infrastructure, deserving the same access control and monitoring as the cloud account it deploys into.
Map the trust
- Who can push to the main branch?
- Which jobs receive secrets?
- Can a pull request from a fork run code with production credentials?
- What can the runner reach on the network?
- Who can change the pipeline definition?
A pipeline that runs untrusted code with broad credentials is a remote code execution path into production.
Credentials
Prefer short-lived, federated credentials scoped to the job. Avoid long-lived cloud keys in repository secrets. If a key must exist, rotate it and limit what it can do.
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.