GitLab
TMA-GITLAB-2.1.5
Ensure access to build environments is limited
说明
Restrict access to the build environment (orchestrator, pipeline executor, their environment, etc.) to trusted and qualified users only. A build environment contains sensitive data such as environment variables, secrets, and the source code itself. Any user that has access to this environment can make changes to the build process, including changes to the code within it. Restricting access to the build environment to trusted and qualified users only will reduce the risk for mistakes such as exposure of secrets or misconfiguration. Limiting access also reduces the number of accounts that are vulnerable to hijacking in order to potentially harm the build environment.
检查方式
审计方法: 人工审核
Verify each build environment is accessible only to known and authorized users. In GitLab, viewing environments in private projects is limited to Reporter roles at least and you must have at least the Developer role to create a new environment - On the left sidebar, select Search or go to and find your project. - Select Manage > Members. - At the top of the member list, from the dropdown list, select Max role the members have in the group and descending order. - If there are minimum number of members with Reporter/Developer role or above in the list, you are compliant.
修复方式
修复方法: 操作指南或基础设施补丁
Restrict access to the build environment to trusted and qualified users. In GitLab, viewing environments in private projects is limited to Reporter roles at least and you must have at least the Developer role to create a new environment - On the left sidebar, select Search or go to and find your project. - Select Manage > Members. - At the top of the member list, from the dropdown list, select Max role the members have in the group and descending order. - Next to the project member you want to remove, select Remove member
属性
- 操作系统
- 任意
- 标签
- access-controldevsecopsgitlab
- 参考
- CIS GitLab Benchmark v1.0.1 - 2.1.5 Ensure access to build environments is limited