#GitLab #Aembit #credential management

Aembit Expands GitLab Capabilities with Credential Lifecycle Management

In a move set to bolster security and efficiency in software delivery, Aembit—a leading company in workload identity and access management (IAM)—has unveiled new capabilities for GitLab. These enhancements focus on reducing the risks associated with long-lived personal access tokens (PATs) and other secrets integral to automating software delivery processes.

The introduction of Credential Lifecycle Management marks a significant advancement in how organizations manage sensitive information. With Aembit Edge being integrated as a native feature within GitLab, static credentials can be replaced by short-lived, policy-controlled access that is generated only as needed. This not only minimizes the danger of misuse but also provides development teams with a streamlined way to manage their pipelines.

GitLab has established itself as one of the most prominent platforms for software development and deployment, facilitating the seamless automation of moving code from a development environment to production. However, its growing popularity has made it a target for security breaches, particularly involving long-lived credentials and unmanaged service accounts. High-profile incidents at organizations like Pearson and the Internet Archive serve as stark reminders of the need for robust security measures. These breaches have resulted in stolen data and significant operational disruptions.

To address these vulnerabilities, Aembit’s Credential Lifecycle Management offers a pragmatic solution. Instead of allowing PATs to persist for extensive periods, Aembit generates credentials that are only active for the duration of a specific pipeline job, automatically expiring them thereafter. The access is verified through cryptographic workload identities and multifactor authentication (MFA) checks, with policies enforced in real-time to ensure that organizations can maintain a clear audit trail of who accessed what, when, and how. Additionally, service accounts are created and decommissioned on demand, guaranteeing that inactive accounts do not remain open.

Aembit’s features are now part of the GitLab CI/CD Component Catalog, making it readily available to GitLab teams without necessitating extra configurations or manual setups. This integration serves to simplify the connection of pipelines to essential services, such as databases and APIs, while also reducing dependence on manually managed secrets and credentials.

Kevin Sapp, co-founder and CTO of Aembit, shared insights on the solution's dual benefits: “Developers want to move quickly without worrying about where a credential is stored or whether it needs to be rotated. Security teams, on the other hand, want assurance that nothing is left exposed. What we've built for GitLab satisfies both needs at once.