Protecting the path to production.
WHY IT MATTERS
Whoever controls the pipeline controls production.
WHAT TO PROTECT
Access to the repository Access to the pipeline configuration The credentials the pipeline holds The ability to deploy
WHAT TO REQUIRE
Individual accounts with a second authentication step Review before merging to the deployable branch Restricted ability to modify the pipeline itself
WHAT TO BE CAREFUL WITH
Pipelines running code from proposed changes, with access to secrets.
WHY
A submitted change could exfiltrate them.
WHAT TO DO ABOUT IT
Do not expose production secrets to builds of untrusted changes.
WHAT TO GIVE THE PIPELINE
Its own credentials, scoped to exactly what it does.
WHAT TO ROTATE
Those credentials, periodically.
WHAT TO LOG
Every deployment: what, when, by whom.
WHAT TO REVIEW
Who can deploy, quarterly.
WHAT TO REMOVE
Access for anyone who has left, the same day.
