Exploring other security hardening techniques
Security should always be on your mind. When we create a way to generate dynamic leases to manage external cloud infrastructure or more, we should be extra diligent in our security requirements and make sure we meet them. A lot of what we did in the last section covered the 101s of role mapping, which we’ll go into in this section.
Implementing CODEOWNERS
Before we jump into OIDC recommendations, I want to call out a common one we all need to follow to limit our chance of disruption or bill shock: CODEOWNERS. I’ve seen a lack of implementation of this in repositories with workflows. If we have a .github directory in our repository, we should have CODEOWNERS protecting that directory and ideally only allowing write access to a team that has undergone some form of GitHub action training. Send them this book if they’ve not.
My first recommendation is to implement a CODEOWNERS file whenever you create a repository...