Security
Terraform security without static cloud keys.
StackShip is a managed OpenTofu platform built so each run gets only what it needs: short-lived cloud credentials, write-only secrets, and an isolated environment discarded after every phase.
Controls
Security controls built into every run.
- 01
Short-lived cloud credentials
OIDC federation for AWS, Google Cloud, and Azure. No cloud keys stored.
- 02
Isolated runs
A fresh environment for each plan and apply, discarded after.
- 03
Write-only secrets
Sensitive variables are write-only and never shown again.
- 04
Protected state
Encrypted at rest, versioned, and downloaded only with a reason.
- 05
Plan-bound approvals
An approval covers one plan, policy result, and state.
- 06
Audit log
Runs, approvals, credentials, and downloads are recorded.
Pull requests
Pull request plans stay safe.
- Pull requests from forks never receive cloud credentials.
- Speculative plans never receive sensitive variables or generic secrets.
- Pull request plans can use a separate, read-only cloud role.
- Secret values are redacted from run logs.
Agent access
Every MCP request is verified.
- Issued by StackShip
- Valid signature
- Not expired
- Audience is the MCP server
- Carries the required scope
- Names exactly one organization
A request that fails any check is rejected.
FAQ
Security questions
How does StackShip access my cloud without static keys?
Through OIDC federation. Each run gets temporary credentials for the AWS role, Google Cloud service account, or Azure application you trust, and no long-lived cloud key is stored in StackShip.
Can a pull request plan read my secrets?
No. Pull requests from forks never receive credentials, and no pull request plan receives sensitive variables. You can give same-repository pull request plans a separate read-only cloud role.
Is OpenTofu state encrypted?
Yes. State is encrypted at rest and every version is kept. Raw state downloads are limited to owners and admins, need a recent sign-in and a reason, and are written to the audit log.
Where do runs execute?
Each plan and apply runs in a fresh Linux environment that is discarded when the phase ends. The apply reuses the exact providers and modules the approved plan downloaded.
How do I report a security issue?
Email compliance@ezgamehost.com with a description of the issue and the steps to reproduce it.
Get started
Run your first plan today.
Free for every organization. Sign up with email or Google.