Ensure deployment configuration manifests are pinned to a specific, verified version

MoyenneNiveau 1Revue manuellegithub

Description

Deployment configuration is often stored in a version control system and is pulled from there. Pin the configuration used to a specific, verified version or commit Secure Hash Algorithm (SHA). Avoid referring configuration without its version tag specified. Deployment configuration manifests are often stored in version control systems and pulled from there either by automation platforms, for example Ansible, or GitOps platforms, such as ArgoCD. Reported as a manual review item: no reliable read-only gh api check exists for this control.

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

For every deployment configuration manifest in use, ensure it is pinned to a specific version or commit Secure Hash Algorithm (SHA). Expected state: For every deployment configuration manifest in use, pin to a specific version or commit Secure Hash Algorithm (SHA).

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

For every deployment configuration manifest in use, pin to a specific version or commit Secure Hash Algorithm (SHA).

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: githubdeployment
Référence: CIS GitHub Benchmark v1.2.0 - 5.1.7 Ensure deployment configuration manifests are pinned to a specific, verified version