What are best practices for securing connections between CI and artifact managers in the cloud?

Question

Bitbucket, github, circleci are examples of Continuous Integration and Continuous Deployment (CI/CD) tools in the cloud.

In the past, a lot of companies ran all services, like CI/CD and artifact managers, like maven, artifactory on premise. The last years more and more services move to the cloud.

One of the advantages of on premise is that one could put everything behind a firewall and then everything that runs behind it could connect to each other.

If companies decide to run CI/CD in the cloud and to store artifacts in another cloud, what security measurements could one apply? One of the thinks I could think of is restricting the firewall, but some services that run on Azure expose a lot of different IPs and then you are basically opening the firewall for everybody in the world.

Answer 1

As I know for Git and Jenkins configuration we use SSH key authentication and secure token for security purpose.

In your case you can't open all port to all then you can set revers proxy for your all URL using apache or nginx and forward traffic to port 80, So when request come first it's hit the port 80 and internally it will hit to your specific application port.