CI/CD Platform  ·  View 20 of 22  ·  Assurance

Trust Zones and Crossings

Four zones. The only upward path out of the untrusted zone is a report the control plane validates.

Editable source SVG draw.io All views
Untrusted — tenant code executes here Fork build sandbox no secrets, no writes Single-use microVM no long-lived creds Per-job agent Mediated — everything the sandbox may reach Egress policy proxy Dependency mirror Cache: read wide, write if trusted Artefact write, scoped Control plane — no tenant code, ever Secret broker Identity federation Attestor Gate decision service Custody — offline or hardware-held Signing key never exported Transparency log write-once Audit trail egress allow-listed reports, not asserts append every verdict CI/CD Platform — Trust Zones and Crossings Risk / gap Security / platform Application we own Data store Decision point synchronous The only upward path from the untrusted zone is a report the control plane validates. Nothing the sandbox says is taken as fact. v 1.0 · owner Platform Engineering · date 2026-09

The boundary this set is built around

  • Tenant code executes only in the untrusted zone, in a single-use sandbox holding no long-lived credential and no cross-tenant write authority.
  • Everything that must be trusted — brokering a secret, signing provenance, deciding a gate, recording an outcome — happens in the control-plane zone, which never executes tenant code.
  • The custody zone holds the signing key, the transparency log and the audit trail. Nothing in it is reachable from the execution plane by any path.

Realisation

  • All sandbox egress is mediated by a policy proxy with a tenant allow-list, and every allowed and denied destination is logged against the run.
  • The cache is read-wide and write-privileged: a fork build reads it and can never write it.
  • Tenant storage isolation is by key prefix and credential, proved by continuous automated test rather than by review.

Risks

  • A confused-deputy bug in the attestor would let one job's report be attributed to another's inputs. The attestor's input validation is the highest-value code in the platform and deserves the most review.
◀  The Run Lifecycle Loop All views Identity — Getting a Credential and Losing It  ▶
Solution Architecture v1.0 · Amazon Web Services · Platform Architecture · 2026-0920-security-trust-zones