Security
Deployment Token Cleanup: Retire Platform Credentials After Pipeline Migrations
Deployment tokens often survive CI/CD migrations. A team moves from one pipeline to another, adopts workload identity, or splits monolith deploys into service-specific releases, but the old platform token remains in secret stores, local machines, and runbooks. Because deployment credentials are powerful and rarely used interactively, stale tokens can linger with little visibility.
Cleanup should prove which release path still needs the credential before revocation.
Inventory token reach
For each token, capture platform, scope, environments, repositories, secret locations, last use, issuer, rotation policy, and owner.
| Token clue | Evidence to inspect | Cleanup concern |
|---|---|---|
| Last use is old | Release cadence and hotfix branches | Supported branches may deploy rarely |
| Broad environment scope | Production, staging, preview, and admin permissions | Narrow before deleting if partial use remains |
| Stored in many places | CI variables, local docs, runbooks, password managers | Revocation may miss copied secrets |
| Replaced by identity federation | Pipeline logs and trust policy | Confirm every deploy path uses the new identity |
| Unknown owner | Repository history and platform audit logs | Escalate before assuming safe removal |
Use audit logs to list successful and failed token use. A failed token use after migration can reveal old automation still trying to deploy.
Do not rush these credentials
Slow down when the token can deploy production, modify DNS, publish packages, rotate secrets, or access customer environments. Also slow down when release branches remain supported; old hotfix workflows may still reference the token even if mainline deploys moved.
Retire with rotation discipline
First, move active pipelines to the replacement credential and run a representative deployment. Second, remove token references from CI variables and runbooks. Third, rotate or revoke the token in the deployment platform. Fourth, monitor for failed deploy attempts and update incident docs so responders do not reintroduce the old credential.
If the token must remain temporarily, reduce scope and set a review date. A broad token waiting for migration is still a risk that needs tracking.
Prevent credential residue
Pipeline migration plans should include deployment token cleanup as an acceptance criterion. New deployment credentials should be environment-scoped, owned by a service, and linked to the pipeline that uses them. Prefer short-lived identity federation when the platform supports it, but still document the cleanup path for any fallback tokens.
Key takeaways
- Deployment token cleanup reduces high-impact stale access.
- Last use must be interpreted against release and hotfix cadence.
- Remove references before revoking so failures are understandable.
- Pipeline migrations should not close until old credentials are retired or scoped down.