The deploy keys in the repo
A pipeline holds long-lived cloud access keys for an admin user as repository secrets. A workflow triggered from a fork leaked them, and nobody had rotated them in over a year.
Rotation shortens the window. It doesn't remove the thing being stolen.
Boundaries, outermost first: Cloud account: Token service (exchanges it), Production, an empty slot for the who may assume the role Outside every boundary: CI runner (your pipeline; FAILED: keys leaked), CI identity issuer (signs a short-lived JWT) Connections: CI identity issuer controls CI runner — short-lived JWT (step 1) CI runner calls Token service — exchange (step 2) who may assume the role controls Token service — gates the exchange Token service calls Production — credentials that expire (step 3)