DOS2280

Do not make the Agent Pool accessible to all YAML Pipelines

DOS2280

AzureDevOps project Severityhigh builtIn

Description

Agent Pool must not be granted access to all YAML pipelines. Lock down the agent pool and only allow selected YAML pipelines to access it. https://learn.microsoft.com/en-us/azure/devops/pipelines/policies/permissions#set-individual-agent-pool-permissions https://learn.microsoft.com/en-us/azure/devops/pipelines/security/resources

En savoir plus

Recommandation

1. Navigate to Project Settings. 
2. Open the Agent pools link under Pipelines. 
3. Select an agent pool. 
4. Click on Security tab. 
5. Review Pipeline permissions and click on 'Restrict permission' to only allowed pipelines.

Règle de politique

{
  "target": "ADOProjectPipelinePermissions",
  "if": {
    "allOf": [
      {
        "resource": "ADOProjectPipelinePermissions",
        "property": "Resource.Type",
        "operator": "equals",
        "value": "queue"
      },
      {
        "resource": "ADOProjectPipelinePermissions",
        "property": "AllPipelines.Authorized",
        "operator": "equals",
        "value": false
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}
« DOS2270 DOS2290 »
Détails de la règle
  • ID de la règle: DOS2280
  • Code: ADO_Project_PipelinePermissions_AgentPool_Dont_Grant_All_YAML_Pipelines_Access
  • Plateforme: AzureDevOps
  • Catégorie: project
  • Sévérité: Severityhigh
  • Type: builtIn
Règles connexes

Copyright © DevOps Shield. Tous droits réservés. Politique de confidentialité | Politique de témoins | Conditions d'utilisation