A security audit of a city CI account finds long-lived IAM access keys embedded in pipeline workers that can deploy across production accounts. What strategy best remediates this secrets and credentials risk?
Select an answer to reveal the explanation.
Short Explanation
Long-lived keys in CI are like a master badge taped to the break-room wall—convenient until someone photographs it. OIDC or assumed roles hand out time-boxed tickets, and Secrets Manager holds what still must be a secret. Rotate the pattern, not just the password on a sticky note.
Full Explanation
Long-lived IAM access keys embedded in pipeline workers that can deploy across production accounts are a critical secrets and credentials risk for a city CI account. Replacing static keys with OIDC federation or short-lived roles assumed by the pipeline, and storing remaining secrets in AWS Secrets Manager with rotation where applicable, removes standing credentials from workers. That strategy works because temporary, scoped credentials shrink blast radius and eliminate plaintext keys living for months in CI. Rotating the same static access keys monthly but keeping them in plaintext pipeline environment variables fails by preserving stealable long-lived secrets between rotations. Committing encrypted copies of access keys into the application Git repository fails conceptually—repositories are not a secrets manager and history retains material. Granting the CI user AdministratorAccess in every account so fewer keys are needed fails by concentrating excessive privilege into the remaining identity. Exam caveat: OIDC trust must pin the correct IdP, repo, and branch conditions; misconfigured trust can let unintended pipelines assume deploy roles. Operational check: configure pipeline OIDC to assume a deploy role with least privilege, delete static access keys from the CI account, move residual secrets to Secrets Manager with rotation, and verify a production deploy succeeds without embedded keys.