Project: KICS (Provisioning / Security & Compliance)
File: 5906092d-5f74-490d-9a03-78febe0f65e1.md

title: GitHub Repository Set To Public hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 5906092d-5f74-490d-9a03-78febe0f65e1 Query name: GitHub Repository Set To Public Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: Repositories must be set to private, which means the attribute 'visibility' must be set to 'private' and/or the attribute 'private' must be set to true (the attribute 'visibility' overrides 'private')<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="12" AWSTemplateFormatVersion: "2010-09-09" Resources: MyRepo3: Type: AWS::CodeStar::GitHubRepository Properties: Code: S3: Bucket: "my-bucket" Key: "sourcecode.zip" ObjectVersion: "1" EnableIssues: true IsPrivate: false RepositoryAccessToken: '{{resolve:secretsmanager:your-secret-manager-name:SecretString:your-secret-manager-key}}' RepositoryDescription: a description RepositoryName: my-github-repo RepositoryOwner: my-github-account ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="5" AWSTemplateFormatVersion: "2010-09-09" Resources: MyRepo4: Type: AWS::CodeStar::GitHubRepository Properties: Code: S3: Bucket: "my-bucket" Key: "sourcecode.zip" ObjectVersion: "1" EnableIssues: true RepositoryAccessToken: '{{resolve:secretsmanager:your-secret-manager-name:SecretString:your-secret-manager-key}}' RepositoryDescription: a description RepositoryName: my-github-repo RepositoryOwner: my-github-account ``` ```json title="Positive test num. 3 - json file" hl_lines="5" { "Resources": { "MyRepo5": { "Type": "AWS::CodeStar::GitHubRepository", "Properties": { "Code": { "S3": { "Bucket": "my-bucket", "Key": "sourcecode.zip", "ObjectVersion": "1" } }, "EnableIssues": true, "RepositoryAccessToken": "{{resolve:secretsmanager:your-secret-manager-name:SecretString:your-secret-manager-key}}", "RepositoryDescription": "a description", "RepositoryName": "my-github-repo", "RepositoryOwner": "my-github-account" } } } } ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="14" { "Resources": { "MyRepo6": { "Type": "AWS::CodeStar::GitHubRepository", "Properties": { "Code": { "S3": { "Bucket": "my-bucket", "Key": "sourcecode.zip", "ObjectVersion": "1" } }, "EnableIssues": true, "IsPrivate": false, "RepositoryAccessToken": "{{resolve:secretsmanager:your-secret-manager-name:SecretString:your-secret-manager-key}}", "RepositoryDescription": "a description", "RepositoryName": "my-github-repo", "RepositoryOwner": "my-github-account" } } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Resources: MyRepo1: Type: AWS::CodeStar::GitHubRepository Properties: Code: S3: Bucket: "my-bucket" Key: "sourcecode.zip" ObjectVersion: "1" EnableIssues: true IsPrivate: true RepositoryAccessToken: '{{resolve:secretsmanager:your-secret-manager-name:SecretString:your-secret-manager-key}}' RepositoryDescription: a description RepositoryName: my-github-repo RepositoryOwner: my-github-account ``` ```json title="Negative test num. 2 - json file" { "Resources": { "MyRepo2": { "Type": "AWS::CodeStar::GitHubRepository", "Properties": { "Code": { "S3": { "Bucket": "my-bucket", "Key": "sourcecode.zip", "ObjectVersion": "1" } }, "EnableIssues": true, "IsPrivate": true, "RepositoryAccessToken": "{{resolve:secretsmanager:your-secret-manager-name:SecretString:your-secret-manager-key}}", "RepositoryDescription": "a description", "RepositoryName": "my-github-repo", "RepositoryOwner": "my-github-account" } } } } ```