Rules / GL070

GL070 static cloud service-account credential used in CI

Severity: warn
OWASP: CICD-SEC-6 – Insufficient Credential Hygiene

What glsec checks

glsec flags script / before_script / after_script / run:-step commands that authenticate to a cloud provider with a long-lived static service-account credential:

• GCP — gcloud auth activate-service-account or any gcloud … --key-file
• AWS — aws configure set aws_secret_access_key …, or AWS_SECRET_ACCESS_KEY=… set in a script line
• Azure — az login --service-principal … --password …

A static SA key is broad, long-lived, and exfiltratable: a compromised job, a key written to an artifact, or a debug trace exposes it for as long as the key is valid. GitLab, Google, and AWS all recommend keyless OIDC instead — short-lived, audience-scoped tokens via id_tokens: + Workload Identity Federation / AssumeRoleWithWebIdentity.

This targets the authentication pattern, not a leaked value (unlike GL006); the key usually comes from a CI variable, so the concern is the use of a static credential at all. The keyless forms — gcloud … --cred-file, az login --service-principal --federated-token — are not flagged. Pairs with GL009, which keeps the id_tokens: audience narrow.

Trigger example

deploy:
  script:
    - gcloud auth activate-service-account --key-file "$GCP_KEY"   # static SA key

Safe alternative

Use OIDC / Workload Identity Federation with a scoped id_tokens: audience:

deploy:
  id_tokens:
    GCP_TOKEN:
      aud: "https://iam.googleapis.com/projects/…/providers/…"
  script:
    - gcloud auth login --cred-file=<(echo "$GCP_TOKEN" | build-wif-config)   # short-lived, keyless

References

• GitLab: Connect to cloud services with OpenID Connect
• Google: Workload Identity Federation
• AWS: AssumeRoleWithWebIdentity
• GL009: overbroad id_tokens: audience

Documentation for glsec 1.23.0. Source of this page · Rule implementation