Skip to content
Agent Trust Cloud
ConsoleMachine identity

GitHub Actions Deploy

ATC-MID-0002733 · GitHub

RestrictedCI/CD identity

54

moderate risk

Ownership

Why it exists, and who answers for it

Purpose
Builds and deploys the platform services from the main branch.
Business owner
Anders Kohl · Platform Engineering
Technical owner
Anders Kohl · Platform Engineering
Type
CI/CD identity — A build or deployment pipeline.
Environment
production
Last authenticated
26 minutes ago

The chain

From a person to a resource

Every link is a place a question stops being answerable if nobody recorded it.

  1. Human ownerAnders Kohl · Platform Engineering
  2. AI agentCode Review Agent
  3. Machine identityGitHub Actions Deploy
  4. CredentialCloud access key
  5. ResourcesAWS · ECS, AWS · S3 artefacts, AWS · IAM

Risk

Why the score is 54

  • +18

    Credential

    Static AWS access key held in repository secrets

  • +12

    Privilege

    Can deploy directly to production

  • +10

    Cross-account

    Deployment role trusts a second account

  • +8

    External exposure

    Credential is reachable by anyone who can edit a workflow

  • +6

    Compliance

    IAM permissions granted and never once used

  • 54Total

Credentials

What it authenticates with

  • Cloud access keylong-livedBearer secret

    AWS · deployment role

    Last rotated
    214 days ago
    Last used
    26 minutes ago
    Expires
    Never

Effective access

What it can do, against what it has done

Effective permissions, not assigned roles — a role, a group and a resource policy combine into reach that no single screen in the source system shows. 52 of 69 granted actions were not used in the last 90 days.

  • AWS · ECSWrite

    held via Direct role

    48 actions granted, 11 used. 37 could be removed on the evidence.

  • AWS · S3 artefactsWrite

    held via Resource policy

    12 actions granted, 6 used. 6 could be removed on the evidence.

  • AWS · IAMIdentity management

    held via Group membership

    9 actions granted, 0 used. None of this has ever been exercised.

Blast radius

What a compromise of this credential reaches

AWS · ECSAWS · S3 artefactsAWS · IAM

1 agent stops working the moment this identity is quarantined — which is exactly what an operator needs to know before doing it.

Back to the estate · The module behind this view