What the CI platform can touch — the blast radius of a CI compromise

The CI platform is the most privileged piece of infrastructure a team operates. It holds credentials for the cloud accounts, the Kubernetes clusters, the Terraform state, the container registries, the secret stores, and the production network. When the platform is compromised, the attacker inherits that privilege for the lifetime of the credentials. The blast radius is not the runner; the blast radius is whatever the credentials on the runner can reach.

What the CI platform can reach

The platform is a convergence point, not a single system.

flowchart TB
    CI["CI platform"]
    CI --> C["Cloud accounts"]
    CI --> K["Kubernetes clusters"]
    CI --> T["Terraform state"]
    CI --> R["Container registries"]
    CI --> S["Secret stores"]
    CI --> N["Production network"]

The six surfaces are: cloud accounts (IAM roles for provisioning and deploy), Kubernetes clusters (kubectl access to production workloads), Terraform state (the record of what exists), container registries (push to deployed artifacts), secret stores (read at apply time), and the production network (private VPC, bastion, internal services). Each is a production surface.

The blast radius

The blast radius is the union of three properties: the credentials the platform holds, the systems the credentials reach, and the credential’s lifetime. For long-lived keys with quarterly rotation, the blast radius is the entire production account for up to 90 days. For OIDC federation with per-job tokens, the blast radius is the systems the job declared, for the duration of the job.

flowchart LR
    A["CI compromise"] --> B{"Credentials?"}
    B -->|"Long-lived"| C["Prod account\nfor cadence"]
    B -->|"OIDC"| D["Declared role\nfor job duration"]

Five surfaces to defend

The rest of this part covers each surface in depth: cloud access (XC-02), Kubernetes access (XC-03), Terraform state (XC-04), registry and secret stores (XC-05), and the production network (XC-06). Each lesson names the credential, the systems it reaches, and the structural fix.

Production discipline

1. Treat the CI as production infrastructure. Same controls, same audit cadence as the systems it reaches.
2. Inventory the credentials the platform holds. Every key, kubeconfig, token, and path. The inventory is the blast radius.
3. Prefer per-job credentials. OIDC, short-lived tokens, dynamic secrets.
4. Audit the surface quarterly. New workflows, actions, dependencies each expand the blast radius.

Cross-course references

• Part XLI-01 (The runner threat model) names the four attacker profiles the runner must defend against.
• Part XLII-06 (The short-lived credential ideal) covers OIDC federation as the structural fix.
• Part XLI-03 (Production credentials on runners) covers the rotation discipline for credentials.

Quiz