ZSoftly
Talk to our team

Whitepaper · 10 pages · September 2026

CI/CD Pipelines for Infrastructure as Code

No stored credentials, one account per environment

Download the PDF1.0 MBTalk to an engineer
Cover of the CI/CD Pipelines for Infrastructure as Code whitepaperFree download, no form

A reference architecture for Terraform, Ansible and CloudFormation pipelines on AWS: OIDC role chaining, OU-based accounts with StackSets, locked and versioned state, and patterns for GitHub Actions, GitLab CI and Jenkins.

  • CI/CD
  • Terraform
  • OIDC
  • StackSets
  • Multi-Account
Stored Keys
Zero
OIDC and role chaining
Max Session
1 hour
Chained role credentials
Platforms
3
GitHub, GitLab, Jenkins
Rollout
8 wks
Six phases

Inside

What the paper covers

  • Authentication Without Secrets

    OIDC tokens and a minimal auth role limited to assuming deploy roles

  • Tight Trust Policies

    Scope roles to one repository and one CI environment, not a wildcard

  • Account Per Environment

    Start with two accounts, grow into PLT and WKL organizational units

  • Automatic Onboarding

    StackSets add roles and state backends when an account joins an OU

  • Locked, Versioned State

    S3 backend with native locking and object versioning

  • Runs Only When Ready

    Pull request, main and manual triggers, path filters and a four-stage pipeline

Timeline

The plan, phase by phase

  1. 01Identity and accessWeeks 1 to 2
  2. 02State and foundationsWeeks 2 to 3
  3. 03Pipeline designWeeks 3 to 4
  4. 04Shared modulesWeeks 4 to 5
  5. 05Validation and testingWeeks 5 to 6
  6. 06Rollout and handoverWeeks 6 to 8

Get the full paper

10 pages, PDF, 1.0 MB. Your first hour with our engineers is free.

Download the PDFBook a discovery call

More whitepapers

See every whitepaper