In order to store credentials that are required during the runtime of CI/CD, we are making use of AWS SecretsManager. Using IAM roles, we are able to grant slaves permissions to specific credentials. The differentiation here is done between restricted and unrestricted slaves. 

The general rule we employ here is that unrestricted slaves must not have access to any credentials since they run arbitrary and unvalidated code. Only restricted slaves are granted permissions to credentials. For more details, please consult this guide. 

When to use this guide

There are various password-based services where it's required to authenticate with credentials:

1. DockerHub
2. Pip
3. Maven
4. NexusCentral
5. SSH (private key based authentication)

When to NOT use this guide

For some services, there are alternatives to use instead of password-based services:

1. AWS: For AWS, we should always aim to use IAM based authorization. Authentication is automatically done using the IAM roles the slaves have attached. In case you need assistance with this, feel free to attend the Berlin office hours or send an email to dev@mxnet.apache.org.

Configuration

This part explains how to configure credentials. It is aimed towards the people who manage the MXNet CI infrastructure because it requires elevated access permissions. For everybody else, you can simply skip this part.

Usage