GitHub repository defined in Terraform does not have GPG signatures for all commits misconfiguration

GitHub repository defined in Terraform does not have GPG signatures for all commits misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_GIT_6
Category - Subcategory	IAM - Overly Permissive
Provider	OTHER
Severity	LOW
Framework	Terraform

Impact

Requiring signed commits on GitHub is a security practice that ensures every commit is signed with a GPG or S/MIME signature, verifying the identity of the commit author and ensuring that the commit hasn't been tampered with after it was signed. This rule ensures that branch protection rules enforce a requirement for signed commits.

When branch protection rules are configured to require signed commits, it prevents unverified commits from being pushed to the protected branches, thus safeguarding the codebase against unauthorized modifications.

How to Fix

To comply with this rule, you must enable the requirement for signed commits in your GitHub branch protection rules.

By setting the require_signed_commits attribute to true, you enforce that all commits to the protected branch must be signed, thus upholding the integrity and authenticity of your codebase. [source,go]

resource "github_branch_protection" "example" { repository_id = github_repository.example.node_id pattern = "main"

Enforce all commits to be signed

• require_signed_commits = true

... other branch protection settings ...

}