AWS S3 buckets have been breached because someone left full access on.
That’s all it takes—one misconfigured role, one bad token, and your data is gone. If your GitHub CI/CD pipeline is touching S3, you cannot afford sloppy permissions. The fix is simple: enforce AWS S3 read-only roles and lock them down with precise CI/CD controls.
Why S3 Read-Only Roles Are Non-Negotiable
An AWS S3 read-only role stops accidental writes, deletes, or overwrites during builds. It’s the guardrail between your automation and production storage. Continuous integration builds should never have the same power as your admin console. With read-only roles:
- CI pipelines can pull assets without changing them.
- Access keys become low-risk even if leaked.
- Compliance audits pass without endless remediation.
Tying Roles to GitHub CI/CD
A GitHub Actions runner doesn’t know the difference between a read or write unless you tell it. The right approach is to attach an AWS IAM role with the s3:GetObject and s3:ListBucket policies only—then use OIDC (OpenID Connect) to provide short-lived credentials during the CI run.
Steps:
- Create a dedicated IAM role for GitHub OIDC with an S3 read-only policy.
- Restrict trust relationships by
sub so only your org’s repos call it. - Configure GitHub Actions to request a token for the role per workflow.
- Remove all permanent keys from your repository and secrets.
This ensures zero standing permissions in the repo and scopes role use to specific workflows.
Fine-Tuning CI/CD Controls
Role scoping must go beyond “read-only.” Lock it to specific buckets. Use Condition Keys like StringEquals on s3:prefix to protect subfolders. Enforce role session durations that expire within minutes of build completion. Store workflow configs in version control with reviews required for changes to permissions.
Extra hardening comes from:
- Blocking public ACL changes.
- Disabling bucket version deletion for anyone outside of recovery workflows.
- Enabling server-side encryption by default.
Why This Matters Now
Attackers scan public GitHub repos for AWS keys in minutes. Even private repos are breached through compromised developer accounts. Pipelines must assume they’re operating in hostile territory. A read-only role with tight CI/CD integration cuts the blast radius to almost nothing.
See It Live Without the Hassle
You don’t have to spend days setting this up from scratch. With hoop.dev, you can connect your AWS S3 read-only role to GitHub Actions, enforce CI/CD controls, and run secure pipelines in minutes—live, with no manual IAM guesswork. Try it now and see your build logs without risking your data.