Give the pipeline short-lived credentials and scope them per environment

applied · 75 min · Objective 5.3

Task

The pipeline can deploy to production, which makes it production infrastructure. Replace a stored deployment key with an exchanged short-lived credential, scope it per environment, and prove the development path cannot reach production.

Steps

  1. Start with the bad version: a long-lived credential stored in the pipeline's configuration. Record where it is visible from -- the configuration, the job environment, and any log line that echoes it -- in lab/cicd/creds.md.
  2. Replace it: the pipeline presents a token identifying its repository and branch, and exchanges it for a short-lived credential. Record the credential's lifetime.
  3. Scope per environment: the development branch may obtain only the development credential. Attempt to obtain the production credential from a development branch and capture the refusal in lab/cicd/refused.txt.
  4. Protect the definition: make the pipeline file itself require review, then propose a change to it from a feature branch that would grant extra permissions, and capture that it cannot be merged without approval.
  5. Pin every third-party pipeline step to an immutable revision rather than a moving tag, and write in lab/cicd/supply-chain.md why a moving tag in a pipeline step is a supply-chain decision.

Verify

grep -Eci 'long-lived|stored' lab/cicd/creds.md
grep -Ec '[0-9]+ ?(m|min|minute|h|hour)' lab/cicd/creds.md
test -s lab/cicd/refused.txt && grep -Eci 'refus|denied|not permitted' lab/cicd/refused.txt
grep -Eci 'pin|digest|immutable' lab/cicd/supply-chain.md

A recorded credential lifetime and a captured cross-environment refusal. If the development branch could obtain production credentials, the scoping is decorative.

This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.