CircleCI accesses cloud provider using insecure long-term credentials

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_87
Category	Credential Hygiene
Severity	MEDIUM

Impact

CircleCI uses long-term credentials to authenticate cloud service providers when running pipeline jobs. These credentials are stored as environment variables in CircleCI. Attackers who gain access to a user with write permissions can expose these secrets, allowing them long term access to the cloud service provider.