DevOps: Securing a CI/CD Pipeline

How do you protect production deployments from supply chain attacks and secure credentials in GitHub Actions?

Technical Reference & Key Concepts

The Challenge: Secure Deployments

You are tasked with reviewing a team's GitHub Actions workflow that builds docker containers and deploys them to AWS.

Core questions to address:

  1. How do you avoid hardcoding AWS Access Keys in GitHub secrets? (Hint: OIDC / IAM Roles)
  2. How do you prevent third-party actions in your workflow from leaking secrets?
  3. What is the security implication of checking in dependencies without a lockfile or hash verification?