I am trying to secure automatic infrastructure provisioning but I am having a hard time designing a proper access policy that would not create a single point of failure (I tried and failed about a year ago already).

How best to design a permission model that would allow to provision my entire cloud infrastructure that prevents a single point of failure (ie. getting access to a single element of a pipeline gives total control of the infrastructure)?

The problem can be separated into 2 parts, easy and hard:

The easy part is application specific infrastructure: I create a service account with permission to a dedicated namespace/resource group and automatic provisioning (or dev) can act within those boundaries. This can include user management. Even if this pipeline is compromised, only the application infrastructure is at risk.

The hard part is anything above that - global access management, setting up shared infrastructure, and setting up pipelines themselves. No matter how I approach this, it seems at some point I need a super admin (or something that can escalate permissions to such a level) that can do everything which means that getting access to this pipeline is equal to getting access to my entire infrastructure.

This is what I considered:

  • same access as a human administrator so it only acts as an automation tool for them. I only give access to a pipeline to admins with the same rights. This way risk and impact seems similar to compromising the admins. However, in my mind this is not true, because someone can also compromise this specific pipeline (ex. access misconfiguration, workload can leak credentials into lower access tools like logs, etc.)
  • split deployments into access management and fine grain infrastructure provisioning. In this case compromised access management pipeline can escalate permissions to super admin for someone/some service account.
  • split pipelines bases on area/responsibility. In this case I see a core pipeline that sets up core infrastructure for other pipelines which basically means it can set up everything.
  • just in time permissions with an approval from a human operator. Seems like the best option, because even though it has wide access rights, a pipeline and the approval process need to compromised at the same time. At the moment, it seems this is too expensive and complicated to set up
  • some things cannot be automated and I need to execute some provisioning (ex. giving access rights) manually which allows me to mitigate some risks using procedures


You must log in to answer this question.

Browse other questions tagged .