Ensure access to build process triggering is minimized

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

For every pipeline in use, verify only the necessary users have permission to trigger it. - On the left sidebar, select Search or go to and find your project. - Select Manage > Members - At the top of the member list, from the dropdown list, sort by Max role the members have in the group - Review the members to ensure relevant members are allowed to trigger pipelines in protected environments.

조치 방법

조치 방식: 가이드 또는 인프라 패치

For every pipeline in use, grant only the necessary users permission to trigger it. - On the left sidebar, select Search or go to and find your project. - Select Settings > CI/CD. - Expand Protected environments. - Select Protect an environment. - From the Environment list, select the environment you want to protect. - In the Allowed to deploy list, select the role, users, or groups you want to give deploy access to. Keep in mind that: o There are two roles to choose from: ▪ Maintainers: Allows access to all of the project’s users with the Maintainer role. ▪ Developers: Allows access to all of the project’s users with the Maintainer and Developer role. o You can only select groups that are already invited to the project. o Users must have at least the Developer role to appear in the Allowed to deploy list. - In the Approvers list, select the role, users, or groups you want to give deploy access to. Keep in mind that: o There are two roles to choose from: ▪ Maintainers: Allows access to all of the project’s users with the Maintainer role. ▪ Developers: Allows access to all of the project’s users with the Maintainer and Developer role. o You can only select groups that are already...