A deployment pipeline can, by definition, change production. That makes its credentials among the most valuable in the organisation, and pipelines are often configured quickly and revisited rarely.
Prefer credentials that do not exist at rest
The strongest option is not to store a long-lived key at all. Where your CI system and cloud provider support workload identity federation, the pipeline exchanges a short-lived token for temporary cloud credentials. There is then no secret to leak, rotate or find in a log.
| Approach | Assessment |
|---|---|
| Workload identity federation | Best: no stored secret, short-lived credentials. |
| Secret manager, fetched at run time | Good: one place to rotate, access logged. |
| CI secret store | Acceptable: keep scope tight and audit who can read. |
| Environment variables set by hand | Poor: drifts, hard to rotate. |
| Committed to the repository | Never. |
Scope per pipeline and per environment
- One identity per pipeline, not one shared deployment key.
- Separate credentials for staging and production.
- Permissions limited to the resources that pipeline touches.
- Production deployments gated on an approval or a protected branch.
- An audit trail showing which run made which change.
Guard against leakage in output
- Enable secret masking, and verify it works with a harmless test value.
- Never echo environment variables wholesale in debug steps.
- Be careful with
set -xin shell scripts; it prints arguments. - Treat build logs as readable by anyone with repository access.
- Scan commits for credentials automatically, before they merge.
Third-party actions are supply chain
A pipeline step pulled from a public registry runs with your credentials. Pin third-party actions to a specific commit rather than a moving tag, review what they do before adopting them, and keep the number of them small.
Summary
Use federated short-lived credentials where you can, a secret manager where you cannot, scope per pipeline and environment, mask output, and pin third-party steps. The pipeline deserves the same care as production, because it is production.
