How to protect sensitive values in dotenv artifacts?
Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.
So we have a nifty little container that takes a gitlab CI JWT, turns it in to an openid id_token and then gets AWS credentials via AssumeRoleWithWebIdentity. This exports the AWS keys to a dotenv file that is used by layer CI steps to plan and deploy a terraform. Works beautifully.
The only trouble is the AWS credentials are now job artifacts like a jar bundle or testing report, and are gettable and useable by anyone with access to this project. Is there any way to set these artifacts as “sensitive” or at least only viewable by maintainers, not all members of the project? Do I need a final cleanup step in my job to explicitly delete this artifact when the keys are no longer needed (which still leaves a window for someone to extract and use to keys while the job is running, but reduces greatly the time)