--- title: "Securing CI/CD with IAM Roles" lang: "en" author: "Mohammad Abu Mattar" canonical: https://mkabumattar.com/post/securing-cicd-with-iam-roles --- ![Blog post image for Securing CI/CD with IAM Roles - How to scope IAM roles per environment (dev, staging, production) in a CI/CD pipeline so each stage only gets the permissions it needs, cutting the blast radius if credentials leak or a build step misbehaves.](/_astro/hero.Bl9B2DZz_ZvPR1C.webp) [Home](/)›[Devtips](/devtips)›[All Categories](/devtips/categories)›[DevOps & DevSecOps](/devtips/categories/devops--devsecops) Devtips [Prev in DevOps & DevSecOpsPolicy-as-Code Governance with OPA/Rego](/devtips/post/policy-as-code-opa-rego) [DevOps & DevSecOps](/devtips/categories/devops--devsecops) # Securing CI/CD with IAM Roles [Mohammad Abu Mattar](/authors/mohammad-abu-mattar)Published: 09 Jun 202503 Mins read04 Mins listen [Markdown for AI(opens in a new tab)](/post/securing-cicd-with-iam-roles/index.md "Open the plain-Markdown version of this page, for pasting into an AI tool") TL;DR How to scope IAM roles per environment (dev, staging, production) in a CI/CD pipeline so each stage only gets the permissions it needs, cutting the blast radius if credentials leak or a build step misbehaves. Series [DevOps & CI/CD Pipelines](/series/devops--cicd-pipelines)1/4 [NextArgoCD GitOps: Sync Kubernetes Deployments Automatically from Git](/devtips/post/argocd-gitops-kubernetes-deployments-git-sync) All posts in this series (4) DevTips4 1. [Securing CI/CD with IAM RolesYou are here](/devtips/post/securing-cicd-with-iam-roles) 2. [ArgoCD GitOps: Sync Kubernetes Deployments Automatically from Git](/devtips/post/argocd-gitops-kubernetes-deployments-git-sync) 3. [Docker Multi-Stage Builds: Smaller, Safer Images for Production](/devtips/post/docker-multi-stage-builds-smaller-production-images) 4. [GitHub Actions Secrets and Environment Variables: Handle Config the Right Way](/devtips/post/github-actions-secrets-environment-variables-guide) ### Securing CI/CD with IAM Roles Contents [Why secure your CI/CD pipeline?](#why-secure-your-cicd-pipeline)[Why pipeline security matters](#why-pipeline-security-matters)[Common security risks](#common-security-risks)[The security problem](#the-security-problem)[Over-privileged access](#over-privileged-access)[What it costs when it goes wrong](#what-it-costs-when-it-goes-wrong)[The fix: environment-specific IAM roles](#the-fix-environment-specific-iam-roles)[Separating environments](#separating-environments)[Applying least privilege](#applying-least-privilege)[Tools and platforms](#tools-and-platforms)[Implementation steps](#implementation-steps)[Creating environment-specific roles](#creating-environment-specific-roles)[Mapping permissions](#mapping-permissions)[Audits and updates](#audits-and-updates)[What least privilege gives you](#what-least-privilege-gives-you)[A smaller blast radius](#a-smaller-blast-radius)[Problems surface in dev](#problems-surface-in-dev)[Shorter audits](#shorter-audits)[What's your approach?](#whats-your-approach)[Community discussion](#community-discussion)[Share your experience](#share-your-experience) ## [Why secure your CI/CD pipeline?](#why-secure-your-cicd-pipeline) ### [Why pipeline security matters](#why-pipeline-security-matters) Your pipeline holds credentials for every environment you deploy to, which makes it one of the most valuable targets you own. A separate IAM role per environment, each carrying only the permissions that environment needs, is the cheapest way to keep that target small. ### [Common security risks](#common-security-risks) Lots of CI/CD setups hand their tools far more access than they need. One long-lived key with broad permissions, shared by every job, because that was the fastest thing to wire up on a Friday. ## [The security problem](#the-security-problem) ### [Over-privileged access](#over-privileged-access) The usual shape is a single set of credentials with something close to admin. It works, so nobody revisits it. Then a test job with production write access runs a script someone edited in a hurry, and the blast radius is your whole account. ### [What it costs when it goes wrong](#what-it-costs-when-it-goes-wrong) Compromised or misconfigured credentials let an attacker reach production systems, read sensitive data or push their own code through your deployment path. The outage is bad. The part where you cannot say which resources were touched is worse. ## [The fix: environment-specific IAM roles](#the-fix-environment-specific-iam-roles) ### [Separating environments](#separating-environments) Set up separate IAM roles for each stage: dev, staging and production. Give each role only the permissions it needs for its job. Your build tool might need to read a code repo, but it has no business touching production data. AWS IAM and GitHub Actions both make this straightforward to wire up. ### [Applying least privilege](#applying-least-privilege) Each environment gets its own IAM role with the minimum permissions it needs. Dev roles build and test. Staging roles deploy to test infrastructure. Production roles get the smallest set that still lets a deploy finish, and nothing else. ### [Tools and platforms](#tools-and-platforms) AWS IAM and GitHub Actions make this easy to set up. GitLab CI, Azure DevOps and Jenkins support the same role-based pattern, so the approach travels if you change platforms. ## [Implementation steps](#implementation-steps) ### [Creating environment-specific roles](#creating-environment-specific-roles) - Create IAM roles for each environment in your pipeline. - Only give the exact permissions needed for each task. - Check roles regularly to keep access tight. ### [Mapping permissions](#mapping-permissions) Write down what each pipeline stage actually does, then grant exactly that: repo read for builds, artifact bucket write for deployments, infrastructure permissions for provisioning. If you can’t explain why a permission is there, take it away and see what breaks in dev. ### [Audits and updates](#audits-and-updates) Permissions accumulate. Someone adds one to unblock a deploy at 6 PM and it stays for two years, so put a recurring review on the calendar and use your provider’s access-analyzer output to find the ones nothing has used. ## [What least privilege gives you](#what-least-privilege-gives-you) ### [A smaller blast radius](#a-smaller-blast-radius) Scoped roles limit what a compromised job can reach. A leaked dev credential gets an attacker a dev environment, and that is the whole point. ### [Problems surface in dev](#problems-surface-in-dev) With roles separated, a job that tries to touch something it shouldn’t fails in dev with a permission error rather than succeeding in production. ### [Shorter audits](#shorter-audits) Compliance work gets easier because the access pattern is already written down as policy. You point at the role definitions instead of reconstructing who could do what. ## [What’s your approach?](#whats-your-approach) ### [Community discussion](#community-discussion) How do you keep your pipelines locked down? Got any tips to share? ### [Share your experience](#share-your-experience) Whether you’re on AWS, GitHub Actions or something else, I’m curious where you drew the line between safe and workable, because too strict and people start bypassing the pipeline entirely. Was this useful? ## Tags [#CICD Security](/devtips/tags/cicd-security)[#IAM Roles](/devtips/tags/iam-roles)[#Least Privilege](/devtips/tags/least-privilege)[#DevSecOps](/devtips/tags/devsecops)[#DevOps](/devtips/tags/devops)[#Cloud Security](/devtips/tags/cloud-security)[#Pipeline Security](/devtips/tags/pipeline-security) ## Share [Facebook](https://facebook.com/sharer/sharer.php?u=https%3A%2F%2Fmkabumattar.com%2Fdevtips%2Fpost%2Fsecuring-cicd-with-iam-roles "Share on Facebook")[Twitter](https://twitter.com/intent/tweet/?text=Securing%20CI%2FCD%20with%20IAM%20Roles&url=https%3A%2F%2Fmkabumattar.com%2Fdevtips%2Fpost%2Fsecuring-cicd-with-iam-roles "Share on Twitter")[LinkedIn](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fmkabumattar.com%2Fdevtips%2Fpost%2Fsecuring-cicd-with-iam-roles&title=Securing%20CI%2FCD%20with%20IAM%20Roles&summary=How%20to%20scope%20IAM%20roles%20per%20environment%20\(dev%2C%20staging%2C%20production\)%20in%20a%20CI%2FCD%20pipeline%20so%20each%20stage%20only%20gets%20the%20permissions%20it%20needs%2C%20cutting%20the%20blast%20radius%20if%20credentials%20leak%20or%20a%20build%20step%20misbehaves.&source=https://mkabumattar.com "Share on LinkedIn")[WhatsApp](https://wa.me/?text=Securing%20CI%2FCD%20with%20IAM%20Roles%20https%3A%2F%2Fmkabumattar.com%2Fdevtips%2Fpost%2Fsecuring-cicd-with-iam-roles "Share on WhatsApp")[Telegram](https://t.me/share/url?url=https%3A%2F%2Fmkabumattar.com%2Fdevtips%2Fpost%2Fsecuring-cicd-with-iam-roles&text=Securing%20CI%2FCD%20with%20IAM%20Roles "Share on Telegram")[Reddit](https://www.reddit.com/submit?url=https%3A%2F%2Fmkabumattar.com%2Fdevtips%2Fpost%2Fsecuring-cicd-with-iam-roles&title=Securing%20CI%2FCD%20with%20IAM%20Roles "Share on Reddit")[Hacker News](http://news.ycombinator.com/submitlink?u=https%3A%2F%2Fmkabumattar.com%2Fdevtips%2Fpost%2Fsecuring-cicd-with-iam-roles&t=Securing%20CI%2FCD%20with%20IAM%20Roles "Share on Hacker News")[Pinterest](https://pinterest.com/pin/create/button/?url=https%3A%2F%2Fmkabumattar.com%2Fdevtips%2Fpost%2Fsecuring-cicd-with-iam-roles&media=&description=How%20to%20scope%20IAM%20roles%20per%20environment%20\(dev%2C%20staging%2C%20production\)%20in%20a%20CI%2FCD%20pipeline%20so%20each%20stage%20only%20gets%20the%20permissions%20it%20needs%2C%20cutting%20the%20blast%20radius%20if%20credentials%20leak%20or%20a%20build%20step%20misbehaves. "Share on Pinterest")[Email]() ## Comments ## You might also enjoy More posts on similar topics [![GitHub Actions Secrets and Environment Variables: Handle Config the Right Way](/_astro/hero.DSfz34Ly_ZH1GxC.webp)](/devtips/post/github-actions-secrets-environment-variables-guide) ## [GitHub Actions Secrets and Environment Variables: Handle Config the Right Way](/devtips/post/github-actions-secrets-environment-variables-guide) - [Mohammad Abu Mattar](/authors/mohammad-abu-mattar) - [DevOps & DevSecOps](/devtips/categories/devops--devsecops) Why secrets handling matters Most CI leaks are config mistakes, not attacks Hey, want to stop leaking credentials in your pipelines? Most secret leaks in CI are not the result of some cle [#GitHub Actions](/devtips/tags/github-actions)[#Secrets](/devtips/tags/secrets)[#Environment Variables](/devtips/tags/environment-variables)+4 tags [read more](/devtips/post/github-actions-secrets-environment-variables-guide) [![ArgoCD GitOps: Sync Kubernetes Deployments Automatically from Git](/_astro/hero.D4Pcicvc_VlKXt.webp)](/devtips/post/argocd-gitops-kubernetes-deployments-git-sync) ## [ArgoCD GitOps: Sync Kubernetes Deployments Automatically from Git](/devtips/post/argocd-gitops-kubernetes-deployments-git-sync) - [Mohammad Abu Mattar](/authors/mohammad-abu-mattar) - [Kubernetes & Containers](/devtips/categories/kubernetes--containers) Why GitOps for Kubernetes? From kubectl apply to Git as the source of truth Hey, want to stop deploying to Kubernetes by hand? If your releases still come from someone running \`kubectl ap [#ArgoCD](/devtips/tags/argocd)[#GitOps](/devtips/tags/gitops)[#Kubernetes](/devtips/tags/kubernetes)+4 tags [read more](/devtips/post/argocd-gitops-kubernetes-deployments-git-sync) [![Docker Multi-Stage Builds: Smaller, Safer Images for Production](/_astro/hero.CI-H9NMO_1DjM7c.webp)](/devtips/post/docker-multi-stage-builds-smaller-production-images) ## [Docker Multi-Stage Builds: Smaller, Safer Images for Production](/devtips/post/docker-multi-stage-builds-smaller-production-images) - [Mohammad Abu Mattar](/authors/mohammad-abu-mattar) - [Kubernetes & Containers](/devtips/categories/kubernetes--containers) Why multi-stage builds matter Image size is really about what is inside Hey, want to stop shipping a toolshed to production? If your Dockerfile builds and runs the app in one stage, your [#Docker](/devtips/tags/docker)[#Multi Stage Build](/devtips/tags/multi-stage-build)[#Container Image](/devtips/tags/container-image)+4 tags [read more](/devtips/post/docker-multi-stage-builds-smaller-production-images) [![Container Image Vulnerability Scanning in CI/CD with Trivy](/_astro/hero.yY1orHlw_2oq3jw.webp)](/devtips/post/container-image-vulnerability-scanning-trivy) ## [Container Image Vulnerability Scanning in CI/CD with Trivy](/devtips/post/container-image-vulnerability-scanning-trivy) - [Mohammad Abu Mattar](/authors/mohammad-abu-mattar) - [DevOps & DevSecOps](/devtips/categories/devops--devsecops) Why container security matters Where the vulnerabilities hide A container image is one of the largest pieces of untrusted code you ship. Every image you build carries the base OS layer, [#Container Security](/devtips/tags/container-security)[#Vulnerability Scanning](/devtips/tags/vulnerability-scanning)[#Trivy](/devtips/tags/trivy)+4 tags [read more](/devtips/post/container-image-vulnerability-scanning-trivy) [![Organizing Terraform with Modules](/_astro/hero.5dVJEd3X_Z16rLJ8.webp)](/devtips/post/organizing-terraform-modules) ## [Organizing Terraform with Modules](/devtips/post/organizing-terraform-modules) - [Mohammad Abu Mattar](/authors/mohammad-abu-mattar) - [Cloud & Infrastructure Automation](/devtips/categories/cloud--infrastructure-automation) Why organize your Terraform code? Where the complexity comes from If you're using Terraform to build out your infrastructure, you know how quickly things get complicated. Every new environmen [#Terraform](/devtips/tags/terraform)[#Infrastructure as Code](/devtips/tags/infrastructure-as-code)[#Modules](/devtips/tags/modules)+4 tags [read more](/devtips/post/organizing-terraform-modules) [![Tracing Microservices with OpenTelemetry](/_astro/hero.BOHz8WyH_Z1IEpz3.webp)](/devtips/post/tracing-microservices-opentelemetry) ## [Tracing Microservices with OpenTelemetry](/devtips/post/tracing-microservices-opentelemetry) - [Mohammad Abu Mattar](/authors/mohammad-abu-mattar) - [Observability & Monitoring](/devtips/categories/observability--monitoring) Why monitor your microservices? The complexity of distributed systems If you're juggling multiple services, it's hard to track how they work together. OpenTelemetry lets you follow one reques [#OpenTelemetry](/devtips/tags/opentelemetry)[#Microservices](/devtips/tags/microservices)[#Distributed Tracing](/devtips/tags/distributed-tracing)+4 tags [read more](/devtips/post/tracing-microservices-opentelemetry) 6 related posts