AZ-400 Question 224
Select 2You are configuring a GitHub Actions workflow that needs to update repositories across multiple GitHub organizations. The organization has strict security policies requiring ephemeral credentials with minimal necessary permissions. Which two authentication methods would best meet these requirements while aligning with GitHub best practices?
- A
Use the automatically generated GITHUB_TOKEN with granular permissions in each workflow.
- B
Use a GitHub App, installed in all relevant organizations, to generate ephemeral installation tokens at runtime.
- C
Create and store a long-lived personal access token (PAT) in repository secrets for all workflows.
- D
Embed your personal access token in the GitHub Actions workflow file for convenience.
Show answer and explanation
Correct answers: A, B
Explanation
For GitHub Actions that require secure, ephemeral credentials, relying on GITHUB_TOKEN or GitHub Apps is recommended by GitHub documentation. Both methods automatically generate time-bound tokens with granular permissions, facilitating security compliance and enforcing least-privilege access. Storing or embedding personal access tokens can introduce unnecessary security risks and does not align with ephemeral credential guidelines. For more details, refer to GitHub documentation on GITHUB_TOKEN usage (https://docs.github.com/actions/security-guides/automatic-token-authentication) and GitHub Apps (https://docs.github.com/developers/apps).
- A. Correct.
Option 1 is correct. The GITHUB_TOKEN is automatically generated by GitHub Actions, is ephemeral, and can be configured with minimal permissions (e.g., 'contents: read' or 'contents: write') to meet least-privilege and security requirements.
- B. Correct.
Option 2 is correct. A GitHub App can be installed in multiple organizations and issues ephemeral installation tokens that can have granular permissions, fulfilling the principle of least privilege and multi-organization access.
- C. Incorrect.
Option 3 is incorrect. Although using personal access tokens (PATs) stored in secrets is common, PATs typically are long-lived and do not meet the strict ephemeral requirement. They also often grant broader permissions than necessary.
- D. Incorrect.
Option 4 is incorrect. Embedding a personal access token directly in the workflow file is a security risk and does not adhere to best practices, as it exposes long-lived credentials in plain text.