Question

A DevOps team's CI/CD pipeline needs to authenticate to a cloud provider to deploy resources. Currently, a long-lived API key is stored in the pipeline configuration, and security auditors flagged it as a risk because the key rarely rotates and could be exposed in logs. The security team wants to minimize the risk of a leaked credential being reused by an attacker. Which PAM approach best addresses this concern?

Accepted Answer

Issue ephemeral credentials that are generated on demand and automatically expire shortly after the deployment completes

Answer

Store the API key in a password vault and require analysts to check it out manually before each pipeline run

Answer

Rotate the long-lived API key on a quarterly schedule and restrict access to the pipeline configuration file

Answer

Apply time-of-day restrictions so the pipeline can only run during business hours