Securing CI/CD pipelines
Our serverless systems are composed of cloud resources, such as functions, datastores and messaging channels, and we use the cloud provider's deployment service, such as AWS CloudFormation, to automate the creation of these resources. In Chapter 12, Choreographing Deployment and Delivery, we will cover the GitOps flow we follow for deploying these resources via our CI/CD pipelines. But first, we need the permissions to create, update and delete these kinds of resources. Plus, we typically use SaaS CI/CD service, such as GitHub Actions or GitLab-CI, and these services execute outside our cloud accounts.So, we need an approach that limits the permissions that we give to these tools. We accomplish this by creating separate roles for the pipeline service and the deployment service. We will also introduce the concept of permission boundaries.You can find a template for securing your CI/CD pipelines here: https://github.com/jgilbert01/template-pipeline-resources...