hardDesignScenarioMidSeniorStaff
Your pipeline deploys using a long-lived cloud access key stored as a CI secret. What would you change and why?
5 min readUpdated 2026-08-15
Answer
Short answer
Replace the stored key with OIDC federation so each job exchanges a short-lived signed token for temporary credentials, then make the trust policy specific to a repository, branch or environment.
Was this answer helpful?
Likely follow-ups
- Your trust policy matches repo:org/app:* and someone opens a pull request from a fork. What can they reach?
- Why is pull_request_target dangerous, and what makes it different from pull_request?
- You pin every action to a commit SHA. What have you given up, and how do you keep them current?
- How would you give a deployment job write access to production while keeping the test job unable to reach it?
Related questions
- A customer's API token turns up in a public repository. What do you do in the next hour, and what in your token design decides how bad this is?hardAlso on least-privilege7 min
- How would you design a deployment pipeline that can be rolled back safely?hardAlso on ci-cd7 min
- What is indirect prompt injection, and how would you defend an assistant that reads user-supplied documents?hardAlso on least-privilege5 min
- What does least privilege look like in practice, and what is separation of duties there to prevent?mediumAlso on least-privilege6 min