DOCS / GUIDES / JENKINS

Integrate CDK with Jenkins

6 min read Requires: Jenkins credential store access

This guide adds CDK to an existing Jenkins pipeline. Unlike GitHub Actions or GitLab CI, Jenkins doesn't have a built-in OIDC token to bind to — so this uses a scoped, rotatable API token instead.

This step differs from the GitHub Actions and GitLab CI guides. Jenkins has no ambient OIDC identity to verify, so CDK falls back to a token you generate and store explicitly.

01 Create a CDK API token

Generate a token scoped to this pipeline:

terminal

$ cdk token create --scope deploy

Treat it like any other pipeline secret. CDK tokens are rotatable and can be revoked independently, without affecting your other integrations.

02 Store it as a Jenkins credential

Add the token as a Secret text credential under Manage Jenkins → Credentials. This guide assumes the credential ID cdk-api-token.

03 Add the attest stage

Jenkinsfile

stage('Attest') {
    steps {
        withCredentials([string(credentialsId: 'cdk-api-token', variable: 'CDK_TOKEN')]) {
            sh 'cdk attest --policy release-policy-v3'
        }
    }
}

04 What you get

On the next deployment, this stage produces a signed node in your Evidence Graph automatically:

An attestation linking the deployment to its approving change
A verified identity tied to the token that triggered the pipeline
A policy evaluation result, pass or fail
A record visible immediately in the Enterprise console — no export required

Full example

A complete Declarative Pipeline, including the deploy stage it runs alongside:

Jenkinsfile

pipeline {
    agent any
    stages {
        stage('Deploy') {
            steps {
                sh './scripts/deploy.sh'
            }
        }
        stage('Attest') {
            steps {
                withCredentials([string(credentialsId: 'cdk-api-token', variable: 'CDK_TOKEN')]) {
                    sh 'cdk attest --policy release-policy-v3'
                }
            }
        }
    }
}

Next steps

Read the Trust Graph Specification→ See how this evidence maps to SOC 2→ Explore the Enterprise console→