TMA-GITLAB-2.1.1
Ensure each pipeline has a single responsibility
Açıklama
Ensure each pipeline has a single responsibility in the build process. Build pipelines generally have access to multiple secrets depending on their purposes. There are, for example, secrets of the test environment for the test phase, repository and artifact credentials for the build phase, etc. Limiting access to these credentials/secrets is therefore recommended by dividing pipeline responsibilities, as well as having a dedicated pipeline for each phase with the lowest privilege instead of a single pipeline for all. This will ensure that any potential damage caused by attacks on a workflow will be limited.
Nasıl denetlenir
Denetim yöntemi: Manuel inceleme
Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.
For each pipeline, ensure it has only one responsibility in the build process.
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
Divide each multi-responsibility pipeline into multiple pipelines, each having a single responsibility with the least privilege. Additionally, create all new pipelines with a sole purpose going forward.
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- ci-cddevsecopsgitlab
- Referans
- CIS GitLab Benchmark v1.0.1 - 2.1.1 Ensure each pipeline has a single responsibility