DOS2320

Do not make the Variable Group with secret variables accessible to all YAML Pipelines

DOS2320

AzureDevOps project high builtIn

Description

Variable Group with secret variables must not be granted access to all YAML pipelines. Lock down the variable group and only allow selected YAML pipelines to access it. Learn more: https://learn.microsoft.com/en-us/azure/devops/pipelines/security/resources

Recommendation

1. Navigate to Project -> Pipelines -> Library 
2. Select a variable group. 
3. Click on 'Pipeline permissions'. 
4. Click on 'Restrict permission'. 
5. Click + to add the YAML pipeline that needs permission to the variable group.

Policy Rule

{
  "target": "ADOProjectPipelinePermissions",
  "if": {
    "allOf": [
      {
        "resource": "ADOProjectPipelinePermissions",
        "property": "Resource.Type",
        "operator": "equals",
        "value": "variablegroup"
      },
      {
        "resource": "ADOProjectPipelinePermissions",
        "property": "AllPipelines.Authorized",
        "operator": "equals",
        "value": false
      },
      {
        "resource": "ADOProjectPipelinePermissions",
        "property": "HasSecrets",
        "operator": "equals",
        "value": true
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}
« DOS2310 DOS2325 »
Rule Details
  • Rule ID: DOS2320
  • Code: ADO_Project_PipelinePermissions_VariableGroup_With_Secrets_Dont_Grant_All_YAML_Pipelines_Access
  • Platform: AzureDevOps
  • Category: project
  • Severity: high
  • Type: builtIn
Related Rules

Copyright © DevOps Shield. All Rights Reserved. Privacy Policy | Cookie Policy | Terms and Conditions