GitHub pull request configurations defined in Terraform have less than 2 approvals misconfiguration

GitHub pull request configurations defined in Terraform have less than 2 approvals misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_GIT_5
Category - Subcategory	IAM - Overly Permissive
Provider	OTHER
Severity	MEDIUM
Framework	Terraform

Impact

Pull request approvals are a critical part of the GitHub workflow, serving as a quality control measure to ensure code is reviewed and vetted before it is merged. Requiring at least two approvals for a pull request before merging can enhance the security and integrity of the code by ensuring that at least two separate individuals have reviewed the changes.

This rule checks that GitHub branch protection rules require at least two approvals on pull requests, which helps prevent unreviewed code from being merged into protected branches.

How to Fix

Ensure your GitHub branch protection rules specify that at least 2 approvals are required before a pull request can be merged.

Adjust the required_approving_review_count to 2 or more to comply with this rule. This change enforces that at least two separate approvals are required, thus implementing a two-person review process for any changes to the code base. [source,go]

resource "github_branch_protection" "example" { repository_id = github_repository.example.node_id pattern = "main"

required_pull_request_reviews {

• required_approving_review_count = 2

... other configurations ...

}

... other branch protection settings ...

}