Whenever you're ready, walk me through how you'd approach this.
How do you secure a CI/CD pipeline and manage IAM roles in a public cloud environment like AWS?
Explain a practical design covering source control, build isolation, artifact promotion, secrets, deployment authorization, and IAM lifecycle management. Include the main threats, concrete AWS controls, monitoring signals with thresholds, and incident response actions.