CI/CD · Ship safely, repeatedly
How should CI/CD pipelines handle secrets?
Short answer
Store secrets in a managed secret store, inject them at runtime, scope them narrowly, prefer short-lived OIDC credentials, mask them in logs, and rotate them. Never commit secrets or bake them into artifacts.
A pipeline is a high-value target because it often has deploy credentials for production. The goal is to avoid long-lived static secrets where possible and to ensure that a compromised job cannot reach more than it needs.
- Use a secret manager such as Vault or a cloud provider secret service as the source of truth
- Prefer OIDC federation to short-lived cloud credentials over stored access keys
- Scope tokens to a repository, environment and permission set
- Mask secrets in logs and avoid printing environment dumps
- Rotate secrets on a schedule and immediately after suspected exposure
- Scan commits and build logs for accidental secret exposure
permissions:
id-token: write
contents: read
steps:
- uses: aws-actions/configure-aws-credentials@<pinned-sha>
with:
role-to-assume: arn:aws:iam::123456789012:role/ci-deploy
aws-region: eu-west-1Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1How do you prevent secrets from leaking into logs?
- 2What are short-lived credentials and why prefer them?
- 3How do you rotate a secret without downtime?
- 4What do you do if a secret is committed to git?
Say it in the interview
I keep secrets in a managed store and inject them only where needed. Where the cloud supports it, I use OIDC so CI assumes a narrowly scoped role instead of holding a long-lived key. I scope tokens per repository and environment, mask output and rotate on a schedule. Untrusted pull requests never get production credentials, and if a secret leaks I rotate it first and then clean up history.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live CI/CD mock interview and get scored feedback on depth, clarity and confidence.