DOS2230

Pipeline Settings - Limit variables that can be set at queue time

DOS2230

AzureDevOps project high builtIn

Description

Enforce settable variables. If enabled, only those variables that are explicitly marked as 'Settable at queue time' can be set at queue time. You can set any variables at queue time unless this option is enabled. With this option enabled, only those variables that are explicitly marked as 'Settable at queue time' can be set. Learn more: https://learn.microsoft.com/en-us/azure/devops/pipelines/security/inputs https://learn.microsoft.com/en-us/azure/devops/organizations/security/security-best-practices

Recommendation

1. Navigate to Project Settings. 
2. Open the Settings link under Pipelines. 
3. Turn 'On' the setting 'Limit variables that can be set at queue time'.

Policy Rule

{
  "target": "ADOProjectPipelineGeneralSettings",
  "if": {
    "allOf": [
      {
        "resource": "ADOProjectPipelineGeneralSettings",
        "property": "EnforceSettableVar",
        "operator": "equals",
        "value": true
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}
« DOS2220 DOS2240 »
Rule Details
  • Rule ID: DOS2230
  • Code: ADO_Project_Pipeline_Settings_Limit_Settable_Variables_At_Queue_Time
  • Platform: AzureDevOps
  • Category: project
  • Severity: high
  • Type: builtIn
Related Rules

Copyright © DevOps Shield. All Rights Reserved. Privacy Policy | Cookie Policy | Terms and Conditions