Ensure access to build process triggering is minimized

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

For every pipeline in use, verify only the necessary users have permission to trigger it. - On the left sidebar, select Search or go to and find your project. - Select Manage > Members - At the top of the member list, from the dropdown list, sort by Max role the members have in the group - Review the members to ensure relevant members are allowed to trigger pipelines in protected environments.

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

For every pipeline in use, grant only the necessary users permission to trigger it. - On the left sidebar, select Search or go to and find your project. - Select Settings > CI/CD. - Expand Protected environments. - Select Protect an environment. - From the Environment list, select the environment you want to protect. - In the Allowed to deploy list, select the role, users, or groups you want to give deploy access to. Keep in mind that: o There are two roles to choose from: ▪ Maintainers: Allows access to all of the project’s users with the Maintainer role. ▪ Developers: Allows access to all of the project’s users with the Maintainer and Developer role. o You can only select groups that are already invited to the project. o Users must have at least the Developer role to appear in the Allowed to deploy list. - In the Approvers list, select the role, users, or groups you want to give deploy access to. Keep in mind that: o There are two roles to choose from: ▪ Maintainers: Allows access to all of the project’s users with the Maintainer role. ▪ Developers: Allows access to all of the project’s users with the Maintainer and Developer role. o You can only select groups that are already...