Gitlab project defined in Terraform does not require signed commits misconfiguration detected in cod

Rule Details

Cortex AppSec Rule ID	APPSEC_GLB_4
Category - Subcategory	IAM - Overly Permissive
Provider	OTHER
Severity	LOW
Framework	Terraform

Impact

In GitLab, administrators can turn on the capability to require signed commits for a project. When you enable required commit signing on a branch, contributors and bots can only push commits that have been signed and verified to the branch. If a collaborator pushes an unsigned commit to a branch that requires commit signatures, the collaborator will need to rebase the commit to include a verified signature, then force push the rewritten commit to the branch.

How to Fix

Resource: gitlab_project

• Attribute: prevent_secrets [source,go]

---

resource "gitlab_project" "example-two" { ... push_rules { ...

• reject_unsigned_commits = true } }

---