Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CircleCI security alert: Rotate any secrets stored in CircleCI

circleci.com

Post reply on HN
Print view View original

11–20 of 87 posts

Re: CircleCI security alert: Rotate any secrets stored in CircleCI

#11

Post by arkadiyt »

ary wrote: post #10
shitlord wrote: post #8

Earlier quoted context omitted.

I recently did this for one of my GitHub repos which runs several test suites (cumulatively taking >1h). If your actions are slow, pay attention to the IAM role session duration. The maximum duration with role chaining is 1 hour. In the end your credentials need to outlive your CI/CD actions.

I believe the max duration of an assumed role session is 12 hours, but this can be changed per-role.

For assuming one role it can be up to 12 hours. If you're doing role chaining like the parent mentioned (where the 1st assumed role then assumes a 2nd role) then the maximum session duration is 1 hour. AWS has this documented here:

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_te...

> Role chaining limits your AWS CLI or AWS API role session to a maximum of one hour.

Re: CircleCI security alert: Rotate any secrets stored in CircleCI

#12

Post by chubs »

Someone please correct me if i'm wrong... but there was a kerfuffle in 2017 about Circle using third-party JS which could be an attack vector: https://news.ycombinator.com/item?id=15442636

To give credence to this, a gitlabber spoke up in that thread, said it was a serious thing and they deliberately had no third-party stuff on their site for that reason.

And I just logged into Circle today, and use the Safari network inspector to see what JS it loads... and it's still plenty of third party stuff that I can see:

* Amplitude * Segment * cci-growth-utils * Statuspage * DataDog * HotJar * Pusher

Not sure if this is an issue, but it doesn't make me comfortable.

Re: CircleCI security alert: Rotate any secrets stored in CircleCI

#15

Post by nixgeek »

What's tricky is this is not the first interesting recent post from Rob, he previously posted on "An Update on CirclCI Reliability" (Dec '22) [1] and "CircleCI remains secure; be vigilant and aware of phishing attempts for your credentials" (Nov '22) [2]. Overall, CircleCI has had a rough run of it lately.

[1] https://circleci.com/blog/an-update-on-circleci-reliability/

[2] https://circleci.com/blog/circleci-security-update/

Re: CircleCI security alert: Rotate any secrets stored in CircleCI

#16

Post by [deleted] »

shitlord wrote: post #8
arkadiyt wrote: post #2

Great reminder for folks to switch any AWS actions you perform from CI/CD to use OIDC role assumption instead of static IAM user credentials. Then even if an attacker stole all your secrets they can't do anything in your AWS account.

I recently did this for one of my GitHub repos which runs several test suites (cumulatively taking >1h). If your actions are slow, pay attention to the IAM role session duration. The maximum duration with role chaining is 1 hour. In the end your credentials need to outlive your CI/CD actions.

[deleted]

Re: CircleCI security alert: Rotate any secrets stored in CircleCI

#20

Post by bazookaworkable »

shitlord wrote: post #8
arkadiyt wrote: post #2

Great reminder for folks to switch any AWS actions you perform from CI/CD to use OIDC role assumption instead of static IAM user credentials. Then even if an attacker stole all your secrets they can't do anything in your AWS account.

I recently did this for one of my GitHub repos which runs several test suites (cumulatively taking >1h). If your actions are slow, pay attention to the IAM role session duration. The maximum duration with role chaining is 1 hour. In the end your credentials need to outlive your CI/CD actions.

Throwaway for reasons:

From experience, be careful and ensure you properly scope your OIDC connection. It’s very easy to allow ANY GitHub repo with proper OIDC connection bits (SA email, connector pool, etc) to get an OIDC token, rather than what you expect, whether that’s any repo in your private org or a specific single repository. As always, RTFM

Post reply on HN