CI/CDCoreOpsThoughtworksAsked in DevOps engineer and Cloud engineer roundsRead the full interview experience →FREE
How should a CI pipeline get cloud credentials to deploy?
The scenario
Today the pipeline uses an AWS access key stored as a repository secret. It has admin rights and hasn't been rotated in 2 years.
Model answer
- Replace long-lived keys with short-lived credentials: OIDC federation from the CI provider (GitHub Actions, GitLab) to an IAM role.
- Scope the role tightly: one role per environment and per pipeline, least privilege, and a trust policy limited to the repo and branch.
- Protect production deploys with environment protection rules and required reviewers.
- Keep app secrets in a secret manager and read them at deploy or run time, not in CI variables.
- Rotate and then delete the old key, and check CloudTrail for its past use.
Common mistakes
- Rotating the admin key instead of removing it
- One role for every environment