Whitepaper · 10 pages · September 2026

# CI/CD Pipelines for Infrastructure as Code

No stored credentials, one account per environment

[Download the PDF 1.0 MB](https://zcp.zsoftly.ca/downloads/whitepapers/cicd-iac-guide.pdf)

[Talk to an engineer](https://calendar.app.google/ceY8b2bxhCYgB1ot9)

[![Cover of the CI/CD Pipelines for Infrastructure as Code whitepaper](https://zcp.zsoftly.ca/images/whitepapers/cicd-iac-guide-cover.webp) Free download, no form](https://zcp.zsoftly.ca/downloads/whitepapers/cicd-iac-guide.pdf)

A reference architecture for Terraform, Ansible and CloudFormation pipelines on AWS: OIDC role chaining, OU-based accounts with StackSets, locked and versioned state, and patterns for GitHub Actions, GitLab CI and Jenkins.

- CI/CD
- Terraform
- OIDC
- StackSets
- Multi-Account

Stored Keys

Zero

OIDC and role chaining

Max Session

1 hour

Chained role credentials

Platforms

3

GitHub, GitLab, Jenkins

Rollout

8 wks

Six phases

Inside

## What the paper covers

- ### Authentication Without Secrets

  OIDC tokens and a minimal auth role limited to assuming deploy roles
- ### Tight Trust Policies

  Scope roles to one repository and one CI environment, not a wildcard
- ### Account Per Environment

  Start with two accounts, grow into PLT and WKL organizational units
- ### Automatic Onboarding

  StackSets add roles and state backends when an account joins an OU
- ### Locked, Versioned State

  S3 backend with native locking and object versioning
- ### Runs Only When Ready

  Pull request, main and manual triggers, path filters and a four-stage pipeline

Timeline

## The plan, phase by phase

1. 01

   Identity and access

   Weeks 1 to 2
2. 02

   State and foundations

   Weeks 2 to 3
3. 03

   Pipeline design

   Weeks 3 to 4
4. 04

   Shared modules

   Weeks 4 to 5
5. 05

   Validation and testing

   Weeks 5 to 6
6. 06

   Rollout and handover

   Weeks 6 to 8

## Get the full paper

10 pages, PDF, 1.0 MB. Your first hour with our engineers is free.

[Download the PDF](https://zcp.zsoftly.ca/downloads/whitepapers/cicd-iac-guide.pdf)

[Book a discovery call](https://calendar.app.google/ceY8b2bxhCYgB1ot9)

## More whitepapers

[See every whitepaper](https://zcp.zsoftly.ca/resources/whitepapers/)

- [Compute and Storage, Priced Separately 10 pages · October 2026](https://zcp.zsoftly.ca/resources/whitepapers/compute-storage-priced-separately/)
- [Object Storage by Industry 10 pages · September 2026](https://zcp.zsoftly.ca/resources/whitepapers/object-storage-by-industry/)
- [Building and Operating a Private Cloud on Apache CloudStack and Ceph 10 pages · September 2026](https://zcp.zsoftly.ca/resources/whitepapers/cloudstack-ceph-private-cloud/)
- [Running Authoritative DNS with PowerDNS and dnsdist 10 pages · September 2026](https://zcp.zsoftly.ca/resources/whitepapers/powerdns-authoritative-dns/)
- [Configuration Management at Platform Scale with Ansible 10 pages · September 2026](https://zcp.zsoftly.ca/resources/whitepapers/ansible-configuration-management/)
- [Enterprise EKS Auto Mode Migration Roadmap 10 pages · September 2026](https://zcp.zsoftly.ca/resources/whitepapers/eks-migration-guide/)