Ensure access to build process triggering is minimized

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

For every pipeline in use, verify only the necessary users have permission to trigger it. - On the left sidebar, select Search or go to and find your project. - Select Manage > Members - At the top of the member list, from the dropdown list, sort by Max role the members have in the group - Review the members to ensure relevant members are allowed to trigger pipelines in protected environments.

修補方式

修補方法: 操作指南或基礎設施修補檔

For every pipeline in use, grant only the necessary users permission to trigger it. - On the left sidebar, select Search or go to and find your project. - Select Settings > CI/CD. - Expand Protected environments. - Select Protect an environment. - From the Environment list, select the environment you want to protect. - In the Allowed to deploy list, select the role, users, or groups you want to give deploy access to. Keep in mind that: o There are two roles to choose from: ▪ Maintainers: Allows access to all of the project’s users with the Maintainer role. ▪ Developers: Allows access to all of the project’s users with the Maintainer and Developer role. o You can only select groups that are already invited to the project. o Users must have at least the Developer role to appear in the Allowed to deploy list. - In the Approvers list, select the role, users, or groups you want to give deploy access to. Keep in mind that: o There are two roles to choose from: ▪ Maintainers: Allows access to all of the project’s users with the Maintainer role. ▪ Developers: Allows access to all of the project’s users with the Maintainer and Developer role. o You can only select groups that are already...