Question

A DevOps team runs CI/CD pipelines in a third-party SaaS build platform that must deploy resources into the company's cloud environment. Currently, a long-lived cloud access key is stored as a secret in the build platform. Security has flagged this as a high risk after discovering the key had not been rotated in 14 months and is shared across multiple pipelines. The architecture team must redesign how the pipeline authenticates to the cloud provider. Which approach BEST eliminates the standing credential while maintaining automated deployments?

Accepted Answer

Configure workload identity federation so the build platform presents a signed OIDC token that the cloud provider exchanges for short-lived, scoped credentials

Answer

Store the access key in a cloud-hosted secrets manager and have the pipeline retrieve it at runtime, with automatic 30-day rotation enabled

Answer

Create a dedicated service account with a new long-lived key per pipeline and restrict each key with IP allow-listing to the build platform's ranges

Answer

Encrypt the existing access key with a customer-managed key and require MFA for any engineer who edits the pipeline configuration