Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
CI/CD identity and project surface V-033
Checks build and pipeline roles, source credentials, webhook filters and the subjects CI identities are trusted for.
Checks
| Checks | Needs |
|---|---|
| Checks that no build project runs as an administrator role. | cicd project, iam role |
| Checks that builds started by outside contributors' changes are limited to an allow-list of accounts. | cicd project |
| Checks that no build project is readable by anyone. | cicd project |
| Checks that no build project keeps secret-named variables in plaintext. | cicd project |
| Checks that stored source-provider credentials are revocable apps, not long-lived tokens. | cicd source credential |
Coverage
Read everywhere
| global | |
|---|---|
‹prod-acct› 123456789012 | Read |
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
GetPolicyVersion of the offending document → scope down by PR; reversible