Gitlab branch protection rules defined in Terraform allow force push misconfiguration detected in co

Gitlab branch protection rules defined in Terraform allow force push misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_GLB_2
Category - Subcategory	IAM - Overly Permissive
Provider	OTHER
Severity	MEDIUM
Framework	Terraform

Impact

Force pushing to a Git branch overrides the existing history on that branch, which can lead to irreversible loss of data and potential disruption in the collaborative development process. It can also inadvertently overwrite changes made by others, leading to confusion and conflicts within the team. This rule ensures that GitLab branch protection rules are set to prevent force pushes, thereby preserving the integrity of the branch history.

How to Fix

To adhere to this rule, ensure that the allow_force_push setting in GitLab branch protection is set to false.

By setting allow_force_push to false, you ensure that the historical integrity of the branch is preserved and that force pushes, which can potentially disrupt the repository's history and ongoing work, are not allowed. [source,go]

resource "gitlab_branch_protection" "example" { project = gitlab_project.example.id branch = "main"

Disable force pushes to the protected branch

• allow_force_push = false

... other branch protection settings ...

}