I'm looking at using a cloud-based continuous deployment server to push production code for my application.
Because it's a cloud based server, this requires me to give them a private SSH key that has access to push the appropriate files to my production server. I figure with the principle of least privilege, this SSH key should allow login to a locked-down user with write privileges to only a few directories. Then the production server can use upstart or other types of scripts that detect the code changes and start running the new code.
Suppose my threat model is that the private SSH key gets leaked from their end. Is it possible to mitigate this risk at all? Even if I lock down the user as much as possible, eventually code that is pushed by the user will be executed by the webserver user (which has greater privileges). So it seems that any leak of the SSH key that I give them will result in the possibility of remote code execution.
Are there any best practices in setting up a cloud-based CI/CD server, or is that just a risk I have to take?