TMA-GITLAB-2.2.7
Ensure build workers' deployment configuration is stored in a version control platform
説明
Store the deployment configuration of build workers in a version control platform, such as GitLab. Build workers are a sensitive part of the build phase. They generally have access to the code repository, the Continuous Integration platform, the deployment platform, etc. This means that an attacker gaining access to a build worker may compromise other platforms in the organization and cause a major incident. One thing that can protect workers is to ensure that their deployment configuration is safe and well-configured. Storing the deployment configuration in version control enables more observability of these configurations because everything is catalogued in a single place. It adds another layer of security, as every change will be reviewed and noticed, and thus malicious changes will theoretically occur less. In the case of a mistake, bug, or security incident, it also offers an eas...
チェック方法
監査方法: 手動レビュー
この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。
Verify that the deployment configuration of build workers is stored in a version control platform. - On the left sidebar, select Code > Repository. - Check if a .gitlab-ci.yml file is at the root of your repository.
修正方法
修正方法: ガイダンスまたは IaC パッチ
Document and store every deployment configuration of build workers in a version control platform. - On the left sidebar, select Code > Repository. - Above the file list, select the branch you want to commit to. If you’re not sure, leave master or main. Then select the plus icon () and New file: - For the Filename, type .gitlab-ci.yml. - Select Commit changes.
プロパティ
- オペレーティングシステム
- すべて
- タグ
- devsecopsgitlab
- 参照
- CIS GitLab Benchmark v1.0.1 - 2.2.7 Ensure build workers' deployment configuration is stored in a version control platform