Is it possible to setup a CICD pipeline so that it executes with the permissions of the user who triggered the build? If so which tools support this?
Apologies if this is a naive question as I am new to CICD. We are trying to setup a CICD pipeline for our project which requires access to a restricted database. The issue we are facing is that each user on the project has different levels of access (which I believe is managed via LDAP) within the database (for example user A can access datasets X, Y & Z whilst user B can only access Z & W).
Due to the nature of our work, code is typically executed interactively (something we are trying to move away from) and such to execute any api that access the database users need to enter their username and password i.e.
get_data(dataset = A, username = $USER, password=$PASSWORD)
Our challenge is thus how to enable the CICD pipeline to access these data-assets without accidentally enabling people to access data that they shouldn't have access to.
I think the most obvious solution is to create a user account for the CICD tool itself, only giving it access to the datasets it needs and then embedding the username and password as secrets within the CICD tool. Our fear with this is that it then means that the project owner becomes responsible for ensuring that everyone with write access to the project has access to the data-assets that the project uses. Given user permissions change fairly frequently (as does project ownership) this doesn't seem like the safest or most sustainable way of solving the problem.
Ideally we are looking for a solution where the CICD tool executes with the same permissions as the user who triggered the build. Are there any tools that support this ? Or alternatively are there any different solutions that could solve our use-case?
Any help/guidance/pointers would be greatly appreciated !