Kill Your Service Account Keys: Secure GitLab CI/CD on Google Cloud

Sun, 15 Dec 2024 00:00:00 +0000

If your CI/CD pipeline authenticates to Google Cloud with a service account key stored in a CI variable, you have a problem. You might not know it yet, but you have a problem.

That JSON key file is a static credential. It doesn’t expire (unless you rotate it, which you don’t). It has no context about who or what is using it. If it leaks — and CI variables leak more often than anyone admits — an attacker gets the same access your pipeline has. Forever, or until someone notices.

So I built a POC to try the alternative: a keyless, signed, vulnerability-gated pipeline from GitLab to Google Cloud. No service account keys. No stored secrets.

Workload-Identity on Andrea Cervesato

Kill Your Service Account Keys: Secure GitLab CI/CD on Google Cloud