Outside a Config File: Secrets Management

[felixshiftellecon]

Outside a Config File

Secrets Management

OIDC

Attempt to replace any static credentials used in CircleCI for connection to cloud environments with authentication using OIDC tokens. This is not available for all tools so some credentials may need to remain. A rotation policy should be created for those remaining credentials.

A common and secure alternative to having static credentials in CircleCI is storing them in a secrets manager, like Vault or AWS Secrets Manager. OIDC can be used to authenticate with the secrets manager tool and pull secrets into the job.

Contexts

For github orgs, ensure contexts are restricted to applicable security groups. If possible, migrate important secrets to a secrets manager and use OIDC to pull those secrets into jobs.

---

Next Step: Outside the Config: Storage Usage

Previous Step: Outside the Config: Security Settings

📑 Table of Contents

Self Service Configuration Review Overview

1. Configuration Review Preparation
   • Document the Config Review
   • Review CircleCI Features
   • Snapshot Project Metrics
2. Review Each Job for Improvement Opportunities
   • General Job Opportunities
   • Execution Environment Opportunities
   • Opportunities for Jobs with High Duration
3. Review Each Workflow for Improvement Opportunities
4. High Level Improvement Opportunities
   • Inside the Config
     • Config Security
     • Reusable Config
     • Dynamic Configuration
   • Outside the Config
     • Security Settings
     • Secret Management
     • Storage Usage
     • Project Settings
5. Finalize Review