CircleCI

Secure your CircleCI runners and use them to access your targets via BastionZero service accounts

This guide explains how to use BastionZero to secure your CircleCI runners and close off a vulnerable access point in your infrastructure. It also demonstrates how to leverage BastionZero service accounts to access your targets through CircleCI.
Get your target off the public internet.
The following example is for a Linux target. BastionZero also secures access to Kubernetes clusters, databases, and web servers.
To secure your Linux target with BastionZero, you will need to do the following:
1.​Install the Zero Trust Command Line Interface (ZLI) on your local machine (if you have not already done so).
2.​Install the BastionZero agent, bzero, on your target. 
3.​Register the agent with BastionZero.
4.Ensure that the appropriate users have access to your target via policy.
5.Verify your policy rules by connecting to your target using zli connect {target-user}@{target-name}.
6.Your target is now secured with BastionZero! You can close any open ports and remove long-lived credentials, such as Secure Shell (SSH) keys.
Set up your CircleCI runner.
After securing your target, we can set up the CircleCI runner. If you already have a config.yaml you would like to use, feel free to skip directly to the next section.
1.Create a new pipeline in CircleCI by connecting to a code repository of your choosing and newly creating or importing an existing /.circleci/config.yaml.
2.[Self-hosted runners only]. Create a new self-hosted runner using the CircleCI web app. You can learn about self-hosted runners through CircleCI's documentation. Specific instructions for creating a runner on a Linux machine can be found here. Note that instead of using SSH to access your target, use BastionZero to create a shell session via zli connect {target-user}@{target-name}.
3.You are ready to add your first job! Continue to the section below to see how you can access your BastionZero targets with CircleCI.
Access your BastionZero targets using your CircleCI runner.
Once you have your runner set up, it is time to give it a job. Although jobs are going to be very specific to your own workflows, we will show you how you can access your BastionZero targets using CircleCI runners and BastionZero's service accounts.
1.If you have not created a BastionZero service account yet, follow these instructions to get started.
2.Copy and paste the below config in your /.circleci/config.yaml file. This job will first download the ZLI onto your target. Then, it will retrieve the BastionZero service account credentials from your Amazon Simple Storage Service (S3) bucket using the Amazon Web Services (AWS) credentials configured with CircleCI. Finally, it will log in to BastionZero as your BastionZero service account. From here, your service account can carry out any necessary tasks through BastionZero. Make sure you update the AWS URIs below to point at your S3 buckets.
3.To configure your AWS credentials with CircleCI, navigate to your project. Click the ellipses on the right of your project name and select "Project Settings" -> "Environment Variables." Add two environment variables: AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. Ensure these AWS credentials have an Identity and Access Management (IAM) policy that allows access to the S3 bucket storing your BastionZero service account credentials.
4.Commit your config once step 2 is complete and after you have substituted in the right URIs for fetching your BastionZero service account credentials. You should see CircleCI kick off a new workflow with your updated config almost immediately.
Example ./circleci/config.yaml
1
version: 2.1
2
​
3
jobs:
4
  sa-example:
5
    # This example uses an Ubuntu 22.04 image provided by CircleCI
6
    machine:
7
      image: ubuntu-2204:2022.07.1
8
    steps:
9
      # Install the ZLI
10
      - run: sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys E5C358E613982017
11
      - run: sudo add-apt-repository 'deb http://download-apt.bastionzero.com/production/apt-repo stable main' -y
12
      - run: sudo apt update
13
      - run: sudo apt install -y zli
14
      # Install the AWS CLI and download the credential files needed 
15
      # for BastionZero service accounts
16
      - run: pip install awscli
17
      # Make sure to replace these URIs with your own
18
      - run: aws s3 cp s3://circle-ci-sa-example/provider-creds.json provider-creds.json
19
      - run: aws s3 cp s3://circle-ci-sa-example/bzero-creds.json bzero-creds.json
20
      # Log in as your BastionZero service account and list your targets
21
      - run: zli service-account login --providerCreds provider-creds.json --bzeroCreds bzero-creds.json
22
      - run: zli lt
23
​
24
workflows:
25
  sa-workflow:
26
    jobs:
27
      - sa-example

Automation & Integrations - Previous

Third-Party Clients

Next - Automation & Integrations

Slack

Last modified 3mo ago