GitLab
TMA-GITLAB-2.1.5
Ensure access to build environments is limited
설명
Restrict access to the build environment (orchestrator, pipeline executor, their environment, etc.) to trusted and qualified users only. A build environment contains sensitive data such as environment variables, secrets, and the source code itself. Any user that has access to this environment can make changes to the build process, including changes to the code within it. Restricting access to the build environment to trusted and qualified users only will reduce the risk for mistakes such as exposure of secrets or misconfiguration. Limiting access also reduces the number of accounts that are vulnerable to hijacking in order to potentially harm the build environment.
점검 방법
감사 방식: 수동 검토
Verify each build environment is accessible only to known and authorized users. In GitLab, viewing environments in private projects is limited to Reporter roles at least and you must have at least the Developer role to create a new environment - On the left sidebar, select Search or go to and find your project. - Select Manage > Members. - At the top of the member list, from the dropdown list, select Max role the members have in the group and descending order. - If there are minimum number of members with Reporter/Developer role or above in the list, you are compliant.
조치 방법
조치 방식: 가이드 또는 인프라 패치
Restrict access to the build environment to trusted and qualified users. In GitLab, viewing environments in private projects is limited to Reporter roles at least and you must have at least the Developer role to create a new environment - On the left sidebar, select Search or go to and find your project. - Select Manage > Members. - At the top of the member list, from the dropdown list, select Max role the members have in the group and descending order. - Next to the project member you want to remove, select Remove member
속성
- 운영 체제
- 모두
- 태그
- access-controldevsecopsgitlab
- 참고 자료
- CIS GitLab Benchmark v1.0.1 - 2.1.5 Ensure access to build environments is limited