Security Best Practices
StackSage is designed to be low-trust overhead by running in your repo. These practices keep it that way.
Recommended
- Use OIDC: avoid long-lived AWS keys where possible.
- Scope trust policy: restrict to a specific GitHub org/repo and branch/environment if you can.
- Least privilege: prefer a custom policy over broad managed policies.
- Monitor usage: review CloudTrail for role assumptions and unusual API activity.
- Artifact hygiene: restrict repo access and delete old artifacts if needed.