TMA-GITLAB-2.1.5
Ensure access to build environments is limited
Description
Restrict access to the build environment (orchestrator, pipeline executor, their environment, etc.) to trusted and qualified users only. A build environment contains sensitive data such as environment variables, secrets, and the source code itself. Any user that has access to this environment can make changes to the build process, including changes to the code within it. Restricting access to the build environment to trusted and qualified users only will reduce the risk for mistakes such as exposure of secrets or misconfiguration. Limiting access also reduces the number of accounts that are vulnerable to hijacking in order to potentially harm the build environment.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Verify each build environment is accessible only to known and authorized users. In GitLab, viewing environments in private projects is limited to Reporter roles at least and you must have at least the Developer role to create a new environment - On the left sidebar, select Search or go to and find your project. - Select Manage > Members. - At the top of the member list, from the dropdown list, select Max role the members have in the group and descending order. - If there are minimum number of members with Reporter/Developer role or above in the list, you are compliant.
How it is fixed
Fix method: Guidance or infrastructure patch
Restrict access to the build environment to trusted and qualified users. In GitLab, viewing environments in private projects is limited to Reporter roles at least and you must have at least the Developer role to create a new environment - On the left sidebar, select Search or go to and find your project. - Select Manage > Members. - At the top of the member list, from the dropdown list, select Max role the members have in the group and descending order. - Next to the project member you want to remove, select Remove member
Properties
- Operating systems
- Any
- Tags
- access-controldevsecopsgitlab
- Reference
- CIS GitLab Benchmark v1.0.1 - 2.1.5 Ensure access to build environments is limited