Ensure access to build environments is limited

Trung bìnhCấp 1Xem xét thủ cônggitlab

Mô tả

Restrict access to the build environment (orchestrator, pipeline executor, their environment, etc.) to trusted and qualified users only. A build environment contains sensitive data such as environment variables, secrets, and the source code itself. Any user that has access to this environment can make changes to the build process, including changes to the code within it. Restricting access to the build environment to trusted and qualified users only will reduce the risk for mistakes such as exposure of secrets or misconfiguration. Limiting access also reduces the number of accounts that are vulnerable to hijacking in order to potentially harm the build environment.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

Verify each build environment is accessible only to known and authorized users. In GitLab, viewing environments in private projects is limited to Reporter roles at least and you must have at least the Developer role to create a new environment - On the left sidebar, select Search or go to and find your project. - Select Manage > Members. - At the top of the member list, from the dropdown list, select Max role the members have in the group and descending order. - If there are minimum number of members with Reporter/Developer role or above in the list, you are compliant.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Restrict access to the build environment to trusted and qualified users. In GitLab, viewing environments in private projects is limited to Reporter roles at least and you must have at least the Developer role to create a new environment - On the left sidebar, select Search or go to and find your project. - Select Manage > Members. - At the top of the member list, from the dropdown list, select Max role the members have in the group and descending order. - Next to the project member you want to remove, select Remove member

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: access-controldevsecopsgitlab
Tham chiếu: CIS GitLab Benchmark v1.0.1 - 2.1.5 Ensure access to build environments is limited