Organization deploy

Proof on each hop

1. 1. AWS sensor

   Read-only cloud run.

2. 2. Key in the build log

   AKIA key, redacted.

   host: ci.northline.example
   log: build #1844
   key: AKIA[redacted]
   role: build-deploy
   scope: organization deploy
   GuardDuty: no finding (the call looks like the build role)

   Fix. Revoke the key, rotate to short-lived credentials, and stop printing secrets into build logs.

   Open weakness

3. 3. build-deploy

   Organization deploy role.

4. 4. IMDSv1

   The same role is also on the instance metadata service.

   host: ci.northline.example
   IMDSv1: reachable
   role: build-deploy
   credential: [redacted]
   No hop limit required.

   Fix. Require IMDSv2 and a hop limit of 1 on the build host.

   Open weakness

5. 5. Organization deploy

   The key can publish to every account the role reaches.