Least-Privilege CI/CD on AWS: The 4-Layer Pattern That Scales to 200 Pipelines

Short summary

AWS CI/CD pipelines holding broad permissions create dangerous attack surfaces that can expose entire AWS accounts to breach. The 4-layer least-privilege pattern uses OIDC federation for short-lived credentials instead of long-lived access keys, environment-specific IAM roles with strict trust policies pinned to specific branches and environments, permission boundaries, and org-level SCPs. Detailed guide includes working Terraform and CDK implementations for both GitHub Actions and GitLab CI, plus real-world breach examples.

• •OIDC federation replaces long-lived access keys with short-lived credentials; trust policies pin roles to specific branches and environments
• •4-layer guardrails (SCPs, permission boundaries, identity policies, trust policies) ensure any single failure is contained
• •Working code examples for GitHub Actions and GitLab CI, plus incident context from Trivy, tj-actions, and CanisterWorm compromises

Generated with AI, which can make mistakes.