{
  "id": 17118443,
  "title": "Zero Trust CI/CD: Keyless Bitbucket Deployment on Google Cloud",
  "url": "https://urgent.news/2026/10/29/zero-trust-ci-cd-keyless-bitbucket-deployment-on-google-cloud",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-29T20:41:19.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/gde/zero-trust-cicd-keyless-bitbucket-deployment-on-google-cloud-1ka1"
  },
  "original_language": "en",
  "account": "This article discusses the security risks associated with using static Service Account keys for authenticating to Google Cloud Platform (GCP) in Bitbucket CI/CD pipelines and how Workload Identity Federation (WIF) provides a modern, keyless authentication mechanism. It explains the benefits of WIF, which include short-lived token exchange, fine-grained scope control, and reduced security risks. The article outlines the steps required to enable WIF in GCP projects, including creating a Workload Identity Pool and Provider, mapping Bitbucket identity to a GCP Service Account and granting necessary permissions.",
  "summary": "Using static Service Account (SA) keys in CI/CD pipelines has long been a common method for authenticating to Google Cloud Platform (GCP). However, storing long-lived credentials inside external pipeline environment variables introduces severe security vulnerabilities and ongoing operational friction. Google Mandiant demonstrated in a threat intelligence blog post ( Holes in Your Bitbucket: Why…",
  "key_points": [
    "Zero Trust CI/CD addresses static Service Account key risks in Bitbucket pipelines.",
    "Workload Identity Federation (WIF) offers keyless authentication mechanism.",
    "Steps include creating Workload Identity Pool, Provider, and mapping Bitbucket identity."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}