🔧 Least-Privilege CI/CD on AWS: The 4-Layer Pattern That Scales to 200 Pipelines

TL;DR


CI/CD pipelines deploying to AWS need AWS Identity and Access Management (IAM) permissions to do their job, but giving them broad permissions creates the largest unmonitored attack surface in most organizations. The right pattern is:

One repo, many roles. The repo is shared; the IAM role is per-environment, per-pipeline. Trust policies...