AZ-400 Question 223
Select 2Your DevOps team is developing a CI/CD pipeline in GitHub Actions that needs to download dependencies from a private repository in the same GitHub organization. For security reasons, you want to minimize the use of long-lived credentials and implement the principle of least privilege. Which two authentication strategies would you recommend to ensure secure access with minimal privileges?
- A
Use the GITHUB_TOKEN automatically provided by GitHub Actions with read-only permissions for the repository
- B
Create a GitHub App with the necessary read permissions, install it in the organization, and use the app� installation token in the workflow
- C
Generate a Personal Access Token with full access to all repositories and store it in GitHub Actions secrets
- D
Embed an SSH key with read-write permissions directly into the workflow file
Show answer and explanation
Correct answers: A, B
Explanation
GitHub recommends using short-lived tokens with minimal scope to adhere to the principle of least privilege. The GITHUB_TOKEN provided by GitHub Actions is ephemeral, automatically managed by GitHub, and can be granted specific permissions for secure access. For more granular control and security, GitHub Apps can be configured to have only the permissions required. By contrast, broad-scoped personal access tokens or embedded SSH keys typically pose higher security risks if compromised. See GitHub� documentation on managing credentials in workflows for more details.
- A. Correct.
CORRECT: The GITHUB_TOKEN is short-lived and automatically provided to GitHub Actions, which allows it to be granted narrowly scoped permissions (e.g., read-only). This reduces the risk if the token is compromised.
- B. Correct.
CORRECT: A GitHub App can be configured with fine-grained permissions. By installing the App with only the specific read access needed, you minimize privileges while still providing the necessary functionality in the CI/CD process.
- C. Incorrect.
INCORRECT: Generating a Personal Access Token with full access greatly exceeds the required scope and does not automatically expire. If compromised, it can put all your repositories at risk.
- D. Incorrect.
INCORRECT: Embedding an SSH key directly in the workflow file is risky, as anyone with access to the repository or its history may retrieve it. This method also typically exceeds the minimal access needed and can become a security vulnerability.