[{"data":1,"prerenderedAt":2837},["ShallowReactive",2],{"/blog/the-ultimate-guide-to-least-privilege-access-with-gitlab":3,"navigation-en-us":2051,"banner-en-us":2479,"footer-en-us":2489,"blog-post-authors-en-us-Fernando Diaz":2734,"blog-related-posts-en-us-the-ultimate-guide-to-least-privilege-access-with-gitlab":2749,"blog-promotions-en-us":2774,"next-steps-en-us":2827},{"id":4,"title":5,"authors":6,"body":8,"category":2030,"date":2031,"description":2032,"extension":2033,"externalUrl":2034,"faq":2034,"featured":522,"heroImage":2035,"meta":2036,"navigation":522,"path":2037,"seo":2038,"slug":2043,"stem":2044,"tags":2045,"template":2049,"updatedDate":2034,"__hash__":2050},"blogPosts/en-us/blog/the-ultimate-guide-to-least-privilege-access-with-gitlab.md","The ultimate guide to least privilege access with GitLab",[7],"Fernando Diaz",{"type":9,"value":10,"toc":2009},"minimark",[11,28,57,60,99,102,105,118,123,138,155,181,233,240,249,258,261,267,272,275,304,331,335,338,357,360,368,371,379,383,386,443,450,457,460,466,471,474,482,490,496,505,565,581,724,740,782,810,895,905,910,918,923,992,995,998,1001,1010,1018,1021,1029,1032,1038,1042,1045,1048,1054,1058,1072,1076,1079,1089,1092,1149,1155,1159,1173,1177,1186,1189,1193,1196,1207,1210,1255,1261,1265,1271,1277,1282,1288,1294,1298,1304,1307,1313,1318,1322,1330,1333,1350,1354,1357,1413,1416,1422,1426,1429,1433,1442,1450,1453,1464,1467,1473,1477,1480,1486,1490,1494,1497,1511,1514,1525,1531,1535,1538,1569,1572,1597,1600,1604,1607,1615,1619,1626,1634,1648,1652,1655,1658,1707,1713,1719,1724,1727,1733,1737,1740,1757,1763,1767,1773,1776,1782,1786,1789,1792,1795,1801,1804,1810,1815,1820,1825,1828,1836,1839,1862,1868,1899,1902,1922,1925,1936,1940,1943,2005],[12,13,14,15,21,22,27],"p",{},"The principle of least privilege (",[16,17,20],"a",{"href":18,"rel":19},"https://csrc.nist.gov/glossary/term/least_privilege",[],"PoLP",") is a concept in which a user's access rights should be limited to the bare minimum needed for them to complete the tasks required within their respective roles. By implementing PoLP you can enhance your organization's ",[16,23,26],{"href":24,"rel":25},"https://csrc.nist.gov/glossary/term/security_posture",[],"security posture",", complementing zero trust, in the following ways:",[29,30,31,39,45,51],"ul",{},[32,33,34,38],"li",{},[35,36,37],"strong",{},"Reduction of attack surface:"," If credentials are compromised, the\nbreach will be limited to only the paths where the compromised account has access.",[32,40,41,44],{},[35,42,43],{},"Protection against human error:"," Users will not be able to perform\nactions that are not required for their role.",[32,46,47,50],{},[35,48,49],{},"Adherence to compliance:"," Separation of duties and least privilege best\npractices are required for several compliance mandates such as SOC2 and\nHIPAA.",[32,52,53,56],{},[35,54,55],{},"Reduced system downtime:"," By preventing everyone from accessing\ncritical parts of the software development lifecycle (SDLC), there is less likelihood of downtime.",[12,58,59],{},"GitLab provides a variety of different features that allow you to customize the actions a user can perform which assist in the achievement of PoLP.\nThese features include:",[29,61,62,72,81,90],{},[32,63,64,71],{},[35,65,66,70],{},[16,67,69],{"href":68},"#custom-roles-and-granular-security-permissions","Custom roles and granular security\npermissions",":"," Allows creation of roles with permissions that are specific to particular functions required by the organization.",[32,73,74,80],{},[35,75,76,70],{},[16,77,79],{"href":78},"#security-policies","Security policies"," Allows policies to be created\nthat prevent insecure code from being merged into production branches without approval, and run security scanners regardless of your pipeline definition.",[32,82,83,89],{},[35,84,85,70],{},[16,86,88],{"href":87},"#branch-protections-and-code-owners","Branch protections and Code\nOwners"," Imposes further restrictions on certain branches to control permissions such as who can merge, push, etc.\nto defined branches.",[32,91,92,98],{},[35,93,94,70],{},[16,95,97],{"href":96},"#compliance-pipelines-and-frameworks","Compliance pipelines and\nframeworks"," Identifies that your project has certain compliance requirements or needs additional oversight, enforcing a pipeline configuration to the projects on which it is applied.",[12,100,101],{},"In this blog post, you'll learn each of the features mentioned, how they improve your organization's security posture, as well as how to implement them.",[12,103,104],{},"Watch my video, which introduces you to achieving PoLP with GitLab:",[106,107,110,111],"figure",{"className":108},[109],"video_container","\n  ",[112,113,117],"iframe",{"src":114,"frameBorder":115,"allowFullScreen":116},"https://www.youtube.com/embed/jvZ3eqWMeSY?si=DedSYiBNy2kTLJKo","0","true"," ",[119,120,122],"h2",{"id":121},"custom-roles-and-granular-security-permissions","Custom roles and granular security permissions",[12,124,125,126,131,132,137],{},"GitLab allows you to create ",[16,127,130],{"href":128,"rel":129},"https://docs.gitlab.com/user/custom_roles/",[],"custom roles",", which apply additional permissions to base roles to meet the security needs of your organization. The available ",[16,133,136],{"href":134,"rel":135},"https://docs.gitlab.com/user/permissions/#roles",[],"base roles"," are as follows:",[29,139,140,143,146,149,152],{},[32,141,142],{},"Guest",[32,144,145],{},"Reporter",[32,147,148],{},"Developer",[32,150,151],{},"Maintainer",[32,153,154],{},"Owner",[12,156,157,158,163,164,169,170,175,176,70],{},"Each base role applies a particular set of permissions to a user. Base roles apply different permissions for ",[16,159,162],{"href":160,"rel":161},"https://docs.gitlab.com/user/permissions/#group-members-permissions",[],"group members",", ",[16,165,168],{"href":166,"rel":167},"https://docs.gitlab.com/user/permissions/#project-members-permissions",[],"project members",", and in ",[16,171,174],{"href":172,"rel":173},"https://docs.gitlab.com/user/permissions/#project-features-permissions",[],"project features",".\nFor example, the table below shows which roles can view the project ",[16,177,180],{"href":178,"rel":179},"https://docs.gitlab.com/user/application_security/dependency_list/",[],"dependency list",[182,183,184,197],"table",{},[185,186,187],"thead",{},[188,189,190,194],"tr",{},[191,192,193],"th",{},"Base role",[191,195,196],{},"Can view project dependency list",[198,199,200,208,214,221,227],"tbody",{},[188,201,202,205],{},[203,204,142],"td",{},[203,206,207],{},"❌",[188,209,210,212],{},[203,211,145],{},[203,213,207],{},[188,215,216,218],{},[203,217,148],{},[203,219,220],{},"✅",[188,222,223,225],{},[203,224,151],{},[203,226,220],{},[188,228,229,231],{},[203,230,154],{},[203,232,220],{},[12,234,235,238],{},[236,237],"br",{},[236,239],{},[12,241,242,243,248],{},"The dependency list also known as a software bill of materials (",[16,244,247],{"href":245,"rel":246},"https://about.gitlab.com/blog/the-ultimate-guide-to-sboms/",[],"SBOM","), displays your project's dependencies and key details about those dependencies. It makes sense that only those actively working on a project should be able to see what dependencies are present to limit any exploitation of your application using its dependencies.",[12,250,251,252,257],{},"However, there are cases in which a Guest may need to see the SBOM to assist the organization in ",[16,253,256],{"href":254,"rel":255},"https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/",[],"achieving compliance",".\nBy using custom roles, a new role can be created with all the limited permissions of the Guest role, and additionally, the ability to view the project dependency list can be added. Therefore, we have a Guest assisting us with compliance with the least privileged access required for their job.",[12,259,260],{},"Watch my video on custom roles and granular security permissions with\nGitLab:",[106,262,110,264],{"className":263},[109],[112,265,117],{"src":266,"frameBorder":115,"allowFullScreen":116},"https://www.youtube.com/embed/WyrhkpO5WkI?si=4B4mNYNK9UyNrru8",[268,269,271],"h3",{"id":270},"granular-permissions","Granular permissions",[12,273,274],{},"As of the GitLab 16.8 release, the following granular permissions can be added to any base role:",[29,276,277,280,283,286,289,292,295,298,301],{},[32,278,279],{},"Viewing project code",[32,281,282],{},"Viewing vulnerability reports",[32,284,285],{},"Changing the status of vulnerabilities",[32,287,288],{},"Viewing SBOMs",[32,290,291],{},"Approving merge requests",[32,293,294],{},"Managing project/group access tokens",[32,296,297],{},"Adding/removing group members",[32,299,300],{},"Archiving/unarchiving/removing projects",[32,302,303],{},"Admin Terraform state",[12,305,306,307,312,313,318,319,324,325,330],{},"We will continue to add ",[16,308,311],{"href":309,"rel":310},"https://docs.gitlab.com/user/custom_roles/abilities/",[],"more granular permissions","\nwith each GitLab release. You can learn more about our roadmap for this feature by referring to the ",[16,314,317],{"href":315,"rel":316},"https://gitlab.com/groups/gitlab-org/-/epics/10684",[],"Granular Security Permissions\nEpic"," and provide feedback in the ",[16,320,323],{"href":321,"rel":322},"https://gitlab.com/gitlab-org/gitlab/-/issues/391760",[],"customer feedback\nIssue",". You also have the ability to contribute to GitLab and ",[16,326,329],{"href":327,"rel":328},"https://docs.gitlab.com/development/permissions/custom_roles/",[],"develop your own granular permissions",".",[268,332,334],{"id":333},"implementation-prerequisites","Implementation prerequisites",[12,336,337],{},"The requirements for implementing custom roles are as follows:",[29,339,340,343,346,349],{},[32,341,342],{},"Owner role in the top-level group in which you are creating the custom\nrole",[32,344,345],{},"Administrator for the self-managed instance in which you are creating the\ncustom role",[32,347,348],{},"GitLab Ultimate tier in the top-level group",[32,350,351,352],{},"A ",[16,353,356],{"href":354,"rel":355},"https://docs.gitlab.com/user/profile/personal_access_tokens/#create-a-personal-access-token",[],"personal access token with the API\nscope",[12,358,359],{},"To see custom roles in action requires:",[29,361,362,365],{},[32,363,364],{},"a private project within the top-level group or its subgroups",[32,366,367],{},"a guest user within the private project",[12,369,370],{},"When you enable a custom role for a user with the Guest role, that user has access to elevated permissions, and therefore:",[29,372,373,376],{},[32,374,375],{},"is considered a billable user on self-managed GitLab",[32,377,378],{},"uses a seat on GitLab.com",[268,380,382],{"id":381},"creating-the-custom-role-with-granular-permissions","Creating the custom role with granular permissions",[12,384,385],{},"Now that you know the benefits of implementing custom roles with granular permissions, let's implement them within our GitLab instance:",[387,388,389,406,417,422,428,431,438],"ol",{},[32,390,391,392,330,395],{},"On the left sidebar, select ",[35,393,394],{},"Search or go to",[29,396,397,400],{},[32,398,399],{},"In GitLab SaaS find and select the top-level group in which you want to create a custom role.",[32,401,402,403,330],{},"In GitLab Self-Managed find and select ",[35,404,405],{},"Admin Area",[32,407,408,409,330,412],{},"Select ",[35,410,411],{},"Settings > Roles and Permissions",[29,413,414],{},[32,415,416],{},"In GitLab Self-Managed use the top dropdown list to find and select the top-level group in which you want to create a custom role.",[32,418,408,419,330],{},[35,420,421],{},"Add new role",[32,423,424,425,427],{},"Under Base role to use as a template, select ",[35,426,142],{}," for this tutorial.",[32,429,430],{},"Under Role name, enter the custom role’s title.",[32,432,433,434,437],{},"Under Permissions for the custom role, select ",[35,435,436],{},"Read Vulnerability"," for\nthis tutorial.",[32,439,408,440,330],{},[35,441,442],{},"Create a new role",[12,444,445],{},[446,447],"img",{"alt":448,"src":449},"Create new role screen","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750099455/Blog/Content%20Images/Blog/Content%20Images/image1_aHR0cHM6_1750099455072.png",[451,452,453],"center",{},[454,455,456],"em",{},"Interface for creating a custom role",[12,458,459],{},"After creating the role you should be able to see the new custom role along with its ID, Base role, and Permissions. Be sure to save the ID as it will be used when we assign the custom role to a guest user.",[12,461,462],{},[446,463],{"alt":464,"src":465},"Custom role screen","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750099455/Blog/Content%20Images/Blog/Content%20Images/image2_aHR0cHM6_1750099455073.png",[451,467,468],{},[454,469,470],{},"Security Auditor role created",[12,472,473],{},"Now we must assign the custom role to a group or project member. This can be done as follows:",[387,475,476,479],{},[32,477,478],{},"Invite a user as a direct member with the Guest role to your top-level\ngroup where the custom role was created.",[32,480,481],{},"You can invite them to a sub-group or private project within the\ntop-level group as well.",[29,483,484,487],{},[32,485,486],{},"The guest user should not be able to see any code within the project they\nhave been assigned to.",[32,488,489],{},"Open your terminal.",[387,491,493],{"start":492},3,[32,494,495],{},"Export the required environment variables:",[29,497,498],{},[32,499,500,501],{},"Your ",[16,502,504],{"href":354,"rel":503},[],"personal access token with API\nscope",[506,507,512],"pre",{"className":508,"code":509,"language":510,"meta":511,"style":511},"language-shell shiki shiki-themes github-light","\n$ export TOKEN=glpat-XXXXXXXXXXXX\n\n$ echo $TOKEN\n\nglpat-XXXXXXXXXXXX\n\n\n","shell","",[513,514,515,524,538,542,554,559],"code",{"__ignoreMap":511},[516,517,520],"span",{"class":518,"line":519},"line",1,[516,521,523],{"emptyLinePlaceholder":522},true,"\n",[516,525,527,531,535],{"class":518,"line":526},2,[516,528,530],{"class":529},"s7eDp","$",[516,532,534],{"class":533},"sYBdl"," export",[516,536,537],{"class":533}," TOKEN=glpat-XXXXXXXXXXXX\n",[516,539,540],{"class":518,"line":492},[516,541,523],{"emptyLinePlaceholder":522},[516,543,545,547,550],{"class":518,"line":544},4,[516,546,530],{"class":529},[516,548,549],{"class":533}," echo",[516,551,553],{"class":552},"sgsFI"," $TOKEN\n",[516,555,557],{"class":518,"line":556},5,[516,558,523],{"emptyLinePlaceholder":522},[516,560,562],{"class":518,"line":561},6,[516,563,564],{"class":529},"glpat-XXXXXXXXXXXX\n",[29,566,567],{},[32,568,569,570,575,576,330],{},"The ID of the user we will be granting a custom role to. You can obtain\nthe user id by providing the username to the ",[16,571,574],{"href":572,"rel":573},"https://docs.gitlab.com/api/users/#list-users",[],"User\nAPI",". For more information on using the GitLab API, see the ",[16,577,580],{"href":578,"rel":579},"https://docs.gitlab.com/api/rest/",[],"REST API documentation",[506,582,584],{"className":508,"code":583,"language":510,"meta":511,"style":511},"\n$ curl \"https://gitlab.example.com/api/v4/users?username=fjdiaz\"\n\n[{\"id\":4710074,\"username\":\"fjdiaz\",\"name\":\"Fern\",\"state\":\"active\",\"locked\":false,\"avatar_url\":\"https://gitlab.com/uploads/-/system/user/avatar/4710074/avatar.png\",\"web_url\":\"https://gitlab.com/fjdiaz\"}]\n\n\n$ export USER_ID=4710074\n\n$ echo $USER_ID\n\n4710074\n\n",[513,585,586,590,600,604,678,682,686,699,704,714,719],{"__ignoreMap":511},[516,587,588],{"class":518,"line":519},[516,589,523],{"emptyLinePlaceholder":522},[516,591,592,594,597],{"class":518,"line":526},[516,593,530],{"class":529},[516,595,596],{"class":533}," curl",[516,598,599],{"class":533}," \"https://gitlab.example.com/api/v4/users?username=fjdiaz\"\n",[516,601,602],{"class":518,"line":492},[516,603,523],{"emptyLinePlaceholder":522},[516,605,606,609,612,615,618,620,623,626,629,631,634,636,639,641,644,646,649,651,655,657,660,662,665,667,670,672,675],{"class":518,"line":544},[516,607,608],{"class":552},"[{",[516,610,611],{"class":533},"\"id\"",[516,613,614],{"class":552},":4710074,",[516,616,617],{"class":533},"\"username\"",[516,619,70],{"class":552},[516,621,622],{"class":533},"\"fjdiaz\"",[516,624,625],{"class":552},",",[516,627,628],{"class":533},"\"name\"",[516,630,70],{"class":552},[516,632,633],{"class":533},"\"Fern\"",[516,635,625],{"class":552},[516,637,638],{"class":533},"\"state\"",[516,640,70],{"class":552},[516,642,643],{"class":533},"\"active\"",[516,645,625],{"class":552},[516,647,648],{"class":533},"\"locked\"",[516,650,70],{"class":552},[516,652,654],{"class":653},"sYu0t","false",[516,656,625],{"class":552},[516,658,659],{"class":533},"\"avatar_url\"",[516,661,70],{"class":552},[516,663,664],{"class":533},"\"https://gitlab.com/uploads/-/system/user/avatar/4710074/avatar.png\"",[516,666,625],{"class":552},[516,668,669],{"class":533},"\"web_url\"",[516,671,70],{"class":552},[516,673,674],{"class":533},"\"https://gitlab.com/fjdiaz\"",[516,676,677],{"class":552},"}]\n",[516,679,680],{"class":518,"line":556},[516,681,523],{"emptyLinePlaceholder":522},[516,683,684],{"class":518,"line":561},[516,685,523],{"emptyLinePlaceholder":522},[516,687,689,691,693,696],{"class":518,"line":688},7,[516,690,530],{"class":529},[516,692,534],{"class":533},[516,694,695],{"class":533}," USER_ID=",[516,697,698],{"class":653},"4710074\n",[516,700,702],{"class":518,"line":701},8,[516,703,523],{"emptyLinePlaceholder":522},[516,705,707,709,711],{"class":518,"line":706},9,[516,708,530],{"class":529},[516,710,549],{"class":533},[516,712,713],{"class":552}," $USER_ID\n",[516,715,717],{"class":518,"line":716},10,[516,718,523],{"emptyLinePlaceholder":522},[516,720,722],{"class":518,"line":721},11,[516,723,698],{"class":529},[29,725,726],{},[32,727,728,729,734,735,330],{},"The ID of the custom role. You can obtain the custom role ID from the ID\ncolumn in the ",[16,730,733],{"href":731,"rel":732},"https://docs.gitlab.com/user/custom_roles/#gitlab-saas",[],"custom roles\nUI"," or the ",[16,736,739],{"href":737,"rel":738},"https://docs.gitlab.com/api/member_roles/#add-a-member-role-to-a-group",[],"member roles\nAPI",[506,741,743],{"className":508,"code":742,"language":510,"meta":511,"style":511},"\n$ export CUSTOM_ROLE_ID=1000782\n\n$ echo $CUSTOM_ROLE_ID\n\n1000782\n\n",[513,744,745,749,761,765,774,778],{"__ignoreMap":511},[516,746,747],{"class":518,"line":519},[516,748,523],{"emptyLinePlaceholder":522},[516,750,751,753,755,758],{"class":518,"line":526},[516,752,530],{"class":529},[516,754,534],{"class":533},[516,756,757],{"class":533}," CUSTOM_ROLE_ID=",[516,759,760],{"class":653},"1000782\n",[516,762,763],{"class":518,"line":492},[516,764,523],{"emptyLinePlaceholder":522},[516,766,767,769,771],{"class":518,"line":544},[516,768,530],{"class":529},[516,770,549],{"class":533},[516,772,773],{"class":552}," $CUSTOM_ROLE_ID\n",[516,775,776],{"class":518,"line":556},[516,777,523],{"emptyLinePlaceholder":522},[516,779,780],{"class":518,"line":561},[516,781,760],{"class":529},[29,783,784],{},[32,785,786,787,792,793,798,799,804,805,330],{},"The ID of your group or project. You can obtain the group id from the\n",[16,788,791],{"href":789,"rel":790},"https://docs.gitlab.com/user/group/#get-the-group-id",[],"group UI"," or using the ",[16,794,797],{"href":795,"rel":796},"https://docs.gitlab.com/api/groups/",[],"groups API",". You can obtain the project ID from the ",[16,800,803],{"href":801,"rel":802},"https://docs.gitlab.com/user/project/working_with_projects/#access-the-project-overview-page-by-using-the-project-id",[],"project\nUI","\nor using the ",[16,806,809],{"href":807,"rel":808},"https://docs.gitlab.com/api/projects/",[],"projects API",[506,811,813],{"className":508,"code":812,"language":510,"meta":511,"style":511},"\n$ export GROUP_ID=10087220\n\n$ echo $GROUP_ID\n\n10087220\n\n\n$ export PROJECT_ID=45738177\n\n$ echo $PROJECT_ID\n\n45738177\n\n",[513,814,815,819,831,835,844,848,852,856,860,872,876,885,890],{"__ignoreMap":511},[516,816,817],{"class":518,"line":519},[516,818,523],{"emptyLinePlaceholder":522},[516,820,821,823,825,828],{"class":518,"line":526},[516,822,530],{"class":529},[516,824,534],{"class":533},[516,826,827],{"class":533}," GROUP_ID=",[516,829,830],{"class":653},"10087220\n",[516,832,833],{"class":518,"line":492},[516,834,523],{"emptyLinePlaceholder":522},[516,836,837,839,841],{"class":518,"line":544},[516,838,530],{"class":529},[516,840,549],{"class":533},[516,842,843],{"class":552}," $GROUP_ID\n",[516,845,846],{"class":518,"line":556},[516,847,523],{"emptyLinePlaceholder":522},[516,849,850],{"class":518,"line":561},[516,851,830],{"class":529},[516,853,854],{"class":518,"line":688},[516,855,523],{"emptyLinePlaceholder":522},[516,857,858],{"class":518,"line":701},[516,859,523],{"emptyLinePlaceholder":522},[516,861,862,864,866,869],{"class":518,"line":706},[516,863,530],{"class":529},[516,865,534],{"class":533},[516,867,868],{"class":533}," PROJECT_ID=",[516,870,871],{"class":653},"45738177\n",[516,873,874],{"class":518,"line":716},[516,875,523],{"emptyLinePlaceholder":522},[516,877,878,880,882],{"class":518,"line":721},[516,879,530],{"class":529},[516,881,549],{"class":533},[516,883,884],{"class":552}," $PROJECT_ID\n",[516,886,888],{"class":518,"line":887},12,[516,889,523],{"emptyLinePlaceholder":522},[516,891,893],{"class":518,"line":892},13,[516,894,871],{"class":529},[387,896,897],{"start":544},[32,898,899,900,330],{},"Associate the guest user with the custom role using the appropriate\n",[16,901,904],{"href":902,"rel":903},"https://docs.gitlab.com/api/group_members/#edit-a-member-of-a-group-or-project",[],"group or project\nAPIs",[29,906,907],{},[32,908,909],{},"If the user just needs to role in a project, update the project\nmembership:",[506,911,916],{"className":912,"code":914,"language":915,"meta":511},[913],"language-text","\n\"Authorization: Bearer $TOKEN\" --data '{\"member_role_id\": $CUSTOM_ROLE_ID,\n\"access_level\": 10}'\n\"https://gitlab.example.com/api/v4/projects/$PROJECT_ID/members/$USER_ID\"\n\n","text",[513,917,914],{"__ignoreMap":511},[29,919,920],{},[32,921,922],{},"If the user just needs to role in a group, update the group membership:",[506,924,926],{"className":508,"code":925,"language":510,"meta":511,"style":511},"\n$ curl --request PUT --header \"Content-Type: application/json\" --header\n\"Authorization: Bearer $TOKEN\" --data '{\"member_role_id\": $CUSTOM_ROLE_ID,\n\"access_level\": 10}'\n\"https://gitlab.example.com/api/v4/groups/$GROUP_ID/members/$USER_ID\"\n\n",[513,927,928,932,953,970,975],{"__ignoreMap":511},[516,929,930],{"class":518,"line":519},[516,931,523],{"emptyLinePlaceholder":522},[516,933,934,936,938,941,944,947,950],{"class":518,"line":526},[516,935,530],{"class":529},[516,937,596],{"class":533},[516,939,940],{"class":653}," --request",[516,942,943],{"class":533}," PUT",[516,945,946],{"class":653}," --header",[516,948,949],{"class":533}," \"Content-Type: application/json\"",[516,951,952],{"class":653}," --header\n",[516,954,955,958,961,964,967],{"class":518,"line":492},[516,956,957],{"class":529},"\"Authorization: Bearer ",[516,959,960],{"class":552},"$TOKEN",[516,962,963],{"class":529},"\"",[516,965,966],{"class":653}," --data",[516,968,969],{"class":533}," '{\"member_role_id\": $CUSTOM_ROLE_ID,\n",[516,971,972],{"class":518,"line":544},[516,973,974],{"class":533},"\"access_level\": 10}'\n",[516,976,977,980,983,986,989],{"class":518,"line":556},[516,978,979],{"class":529},"\"https://gitlab.example.com/api/v4/groups/",[516,981,982],{"class":552},"$GROUP_ID",[516,984,985],{"class":529},"/members/",[516,987,988],{"class":552},"$USER_ID",[516,990,991],{"class":529},"\"\n",[12,993,994],{},"Now that the custom role has been applied to a guest user, when they login, they can see the Vulnerability dashboard present in the Secure tab. Notice, however, that they are still not allowed to see the source code.",[12,996,997],{},"This is useful because it allows users to audit the system without being able to make changes to the code base, which applies the PoLP for those auditing the system for vulnerabilities.",[119,999,79],{"id":1000},"security-policies",[12,1002,1003,1004,1009],{},"GitLab provides ",[16,1005,1008],{"href":1006,"rel":1007},"https://docs.gitlab.com/user/application_security/policies/",[],"security policies"," to help you achieve least privilege access. There are two different types of security policies provided by GitLab:",[29,1011,1012,1015],{},[32,1013,1014],{},"Scan Execution\npolicies\nallow project maintainers and administrators the confidence of knowing that the scans they set up have not been changed, altered, or disabled.",[32,1016,1017],{},"Merge Request Approval\npolicies\nprevent insecure code from being merged into production without appropriate approval.",[12,1019,1020],{},"Some examples of how both policy types can be used in unison to provide least privilege access are as follows:",[29,1022,1023,1026],{},[32,1024,1025],{},"remove the ability for developers to disable security scanners",[32,1027,1028],{},"remove the ability for developers to merge insecure code",[12,1030,1031],{},"Policies are stored in a separate repo from the project they are being applied to called the Security Policy Project (SPP). This allows for separate permissions to be set to the SPP vs. the application repo, thus strengthening your ability to separate duties and apply PoLP.",[12,1033,1034],{},[446,1035],{"alt":1036,"src":1037},"Security policy hierarchy","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750099455/Blog/Content%20Images/Blog/Content%20Images/image19_aHR0cHM6_1750099455074.png",[451,1039,1040],{},[454,1041,1036],{},[12,1043,1044],{},"To enforce the policies contained in an SPP you link it to a project, subgroup, group, or multiples of each. An SPP can contain multiple policies but they are enforced together. An SPP enforced on a group or subgroup applies to everything below the hierarchy, including all subgroups and their projects.",[12,1046,1047],{},"Security policies can be managed via the policy management UI as well as via yaml. Using the policy editor you can create, edit, and delete policies.",[12,1049,1050],{},[446,1051],{"alt":1052,"src":1053},"Policy management interface","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750099455/Blog/Content%20Images/Blog/Content%20Images/image20_aHR0cHM6_1750099455076.png",[451,1055,1056],{},[454,1057,1052],{},[12,1059,1060,1061,1066,1067,330],{},"Feel free to leverage the ",[16,1062,1065],{"href":1063,"rel":1064},"https://gitlab.com/gitlab-da/tutorials/security-and-governance/devsecops/simply-vulnerable-notes",[],"Simple Notes demo environment","\nto try this yourself by following the provided ",[16,1068,1071],{"href":1069,"rel":1070},"https://gitlab-de.gitlab.io/tutorials/security-and-governance/devsecops/simply-vulnerable-notes/",[],"DevSecOps tutorial",[268,1073,1075],{"id":1074},"creating-a-scan-execution-policy","Creating a Scan Execution policy",[12,1077,1078],{},"Now let's take a look at how to create a Scan Execution policy. Before getting started make sure you have met the following criteria:",[29,1080,1081,1083,1086],{},[32,1082,348],{},[32,1084,1085],{},"Owner role to create/assign an SPP",[32,1087,1088],{},"Developer role or greater to create/edit/delete individual security\npolicies",[12,1090,1091],{},"We will be creating a policy that automatically runs a SAST scan with each pipeline, regardless of the SAST template is defined within the gitlab-ci.yml:",[387,1093,1094,1099,1105,1110,1120],{},[32,1095,391,1096,1098],{},[35,1097,394],{}," and search for the\nproject to which you wish to add a policy.",[32,1100,1101,1102,330],{},"On the project left sidebar, go to ",[35,1103,1104],{},"Secure > Policies",[32,1106,408,1107,330],{},[35,1108,1109],{},"New policy",[32,1111,1112,1113,1116,1117,330],{},"In the ",[35,1114,1115],{},"Scan Execution Policy"," section, select ",[35,1118,1119],{},"Select policy",[32,1121,1122,1123],{},"Complete the fields:",[29,1124,1125,1131,1137,1143],{},[32,1126,1127,1130],{},[35,1128,1129],{},"Name:"," The name of the policy",[32,1132,1133,1136],{},[35,1134,1135],{},"Description:"," The description of the Policy",[32,1138,1139,1142],{},[35,1140,1141],{},"Policy status:"," Whether it is enabled or not",[32,1144,1145,1148],{},[35,1146,1147],{},"Actions:"," What actions to take when the defined conditions are met",[12,1150,1151],{},[446,1152],{"alt":1153,"src":1154},"Scan Execution policy actions","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750099455/Blog/Content%20Images/Blog/Content%20Images/image15_aHR0cHM6_1750099455077.png",[451,1156,1157],{},[454,1158,1153],{},[29,1160,1161],{},[32,1162,1163,1166,1167,1169],{},[35,1164,1165],{},"Conditions:"," Conditions which must be met (a pipeline is triggered or on a set schedule) in order for an action to take place.",[236,1168],{},[446,1170],{"alt":1171,"src":1172},"Scan Execution policy conditions","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750099455/Blog/Content%20Images/Blog/Content%20Images/image8_aHR0cHM6_1750099455078.png",[451,1174,1175],{},[454,1176,1171],{},[29,1178,1179],{},[32,1180,1181,1182,1185],{},"Press the ",[35,1183,1184],{},"Configure with a merge request"," button.",[12,1187,1188],{},"Now that the policy has been created, all we need to do is run a pipeline to see that SAST will be present even if it is not defined in the\n.gitlab-ci.yml.",[268,1190,1192],{"id":1191},"creating-a-merge-request-approval-policy","Creating a Merge Request Approval policy",[12,1194,1195],{},"Now let's take a look at how to create a Merge Request Approval policy.\nBefore getting started make sure you have met the following criteria:",[29,1197,1198,1200,1202,1204],{},[32,1199,348],{},[32,1201,1085],{},[32,1203,1088],{},[32,1205,1206],{},"Security scanners added to project",[12,1208,1209],{},"We will be creating a policy that requires approval from project maintainers if any security scanner detects a vulnerability when compared with any branch:",[387,1211,1212,1216,1220,1224,1232],{},[32,1213,391,1214,1098],{},[35,1215,394],{},[32,1217,1101,1218],{},[35,1219,1104],{},[32,1221,408,1222],{},[35,1223,1109],{},[32,1225,1112,1226,1116,1229,330],{},[35,1227,1228],{},"Merge Request Approval policy",[35,1230,1231],{},"Select\npolicy",[32,1233,1122,1234],{},[29,1235,1236,1240,1245,1249],{},[32,1237,1238,1130],{},[35,1239,1129],{},[32,1241,1242,1244],{},[35,1243,1135],{}," The description of the policy",[32,1246,1247,1142],{},[35,1248,1141],{},[32,1250,1251,1254],{},[35,1252,1253],{},"Rules:"," The conditions which must be met for an action (require approval) to take place.",[12,1256,1257],{},[446,1258],{"alt":1259,"src":1260},"Merge Request Approval policy rules","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750099455/Blog/Content%20Images/Blog/Content%20Images/image17_aHR0cHM6_1750099455079.png",[451,1262,1263],{},[454,1264,1259],{},[506,1266,1269],{"className":1267,"code":1268,"language":915},[913],"- **Actions:** The action to be taken whenever the conditions in the rules (defined vulnerabilities/licenses detected) are met.\n",[513,1270,1268],{"__ignoreMap":511},[12,1272,1273],{},[446,1274],{"alt":1275,"src":1276},"Merge Request Approval  policy actions","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750099455/Blog/Content%20Images/Blog/Content%20Images/image6_aHR0cHM6_1750099455080.png",[451,1278,1279],{},[454,1280,1281],{},"Merge Request Approval policy actions",[506,1283,1286],{"className":1284,"code":1285,"language":915},[913],"- **Override project approval settings:** If selected, the following choices will overwrite project settings but only affect the branches selected in the policy.\n",[513,1287,1285],{"__ignoreMap":511},[12,1289,1290],{},[446,1291],{"alt":1292,"src":1293},"Merge Request Approval policy approval settings","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750099455/Blog/Content%20Images/Blog/Content%20Images/image21_aHR0cHM6_1750099455081.png",[451,1295,1296],{},[454,1297,1292],{},[387,1299,1300],{"start":561},[32,1301,1181,1302,1185],{},[35,1303,1184],{},[12,1305,1306],{},"Now that the policy has been created, all we need to do is run a pipeline and if SAST detects any vulnerabilities then approvals will be required from the selected approver before the code change can be merged. Merge Request\nApproval policies can be used with all GitLab security scanners, including license scanning.",[12,1308,1309],{},[446,1310],{"alt":1311,"src":1312},"Merge Request Approval policies blocking code from being merged in an\nMR","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750099455/Blog/Content%20Images/Blog/Content%20Images/image3_aHR0cHM6_1750099455082.png",[451,1314,1315],{},[454,1316,1317],{},"Merge Request Approval policies blocking code from being merged in an MR",[119,1319,1321],{"id":1320},"branch-protections-and-code-owners","Branch protections and Code Owners",[12,1323,1324,1329],{},[16,1325,1328],{"href":1326,"rel":1327},"https://docs.gitlab.com/user/project/protected_branches/",[],"Branch protections","\nallow you to impose additional restrictions on particular branches within your repository. This further strengthens the PoLP for the interactions on a particular set of branches.",[12,1331,1332],{},"For example, a protected branch can control:",[29,1334,1335,1338,1341,1344,1347],{},[32,1336,1337],{},"which users can merge into the branch",[32,1339,1340],{},"which users can push to the branch",[32,1342,1343],{},"if users can force push to the branch",[32,1345,1346],{},"if changes to files listed in the CODEOWNERS file can be pushed directly\nto the branch",[32,1348,1349],{},"which users can unprotect the branch",[268,1351,1353],{"id":1352},"applying-branch-protections","Applying branch protections",[12,1355,1356],{},"Branch protections are available in all tiers and offerings of GitLab.\nBranch protections can be applied to a single project or a group of projects. You can apply branch protections for required roles to push and merge as follows:",[387,1358,1359,1364,1369,1375,1395,1402,1408],{},[32,1360,391,1361,1363],{},[35,1362,394],{}," and find your project or\ngroup.",[32,1365,408,1366,330],{},[35,1367,1368],{},"Settings > Repository",[32,1370,1371,1372,330],{},"Expand ",[35,1373,1374],{},"Protected branches",[32,1376,408,1377,330,1380],{},[35,1378,1379],{},"Add protected branch",[29,1381,1382,1389],{},[32,1383,1384,1385,1388],{},"For groups, from the ",[35,1386,1387],{},"Branch"," text box, type the branch name or a wildcard.",[32,1390,1391,1392,1394],{},"For projects, from the ",[35,1393,1387],{}," dropdown list, select the branch you want to protect.",[32,1396,1397,1398,1401],{},"From the ",[35,1399,1400],{},"Allowed to merge"," list, select a role that can merge into\nthis branch.",[32,1403,1397,1404,1407],{},[35,1405,1406],{},"Allowed to push and merge"," list, select a role that can push\nto this branch.",[32,1409,408,1410,330],{},[35,1411,1412],{},"Protect",[12,1414,1415],{},"You should now see the protected branch added to the list.",[12,1417,1418],{},[446,1419],{"alt":1420,"src":1421},"Protected branches settings","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750099455/Blog/Content%20Images/Blog/Content%20Images/image14_aHR0cHM6_1750099455082.png",[451,1423,1424],{},[454,1425,1420],{},[12,1427,1428],{},"The Owner role is required to add branch protections to a group and the\nMaintainer role or greater is required to add branch protections to a project.",[268,1430,1432],{"id":1431},"code-owners","Code Owners",[12,1434,1435,1436,1441],{},"If you want to further limit what files developers can perform changes on, one of the best features to implement is ",[16,1437,1440],{"href":1438,"rel":1439},"https://docs.gitlab.com/user/project/codeowners/",[],"Code\nOwners",". Code Owners allows you to define who has the expertise for specific parts of your project’s codebase. Defining the owners of files and directories in Code\nOwners will:",[29,1443,1444,1447],{},[32,1445,1446],{},"require owners to approve changes as well as merge requests before they\nmerge into a protected branch",[32,1448,1449],{},"identify owners by displaying the Code Owner names on the files and\ndirectories they own",[12,1451,1452],{},"To set up Code Owners, follow these steps:",[387,1454,1455,1458,1461],{},[32,1456,1457],{},"Create a CODEOWNERS file in your preferred location.",[32,1459,1460],{},"Define some rules in the file following the Code Owners syntax reference.\nYou can configure all eligible approvers' approval rules and require Code\nOwner approval on a protected branch.",[32,1462,1463],{},"Commit your changes, and push them up to GitLab.",[12,1465,1466],{},"Now, when looking at files, you can see who the Code Owners are for a particular file.",[12,1468,1469],{},[446,1470],{"alt":1471,"src":1472},"Code Owners displayed for file","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750099455/Blog/Content%20Images/Blog/Content%20Images/image5_aHR0cHM6_1750099455083.png",[451,1474,1475],{},[454,1476,1471],{},[12,1478,1479],{},"If you implement Code Owner approvals, then when creating a merge request, the Code Owners must approve before the code can be merged.",[12,1481,1482],{},[446,1483],{"alt":1484,"src":1485},"Code Owners approvals","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750099455/Blog/Content%20Images/Blog/Content%20Images/image7_aHR0cHM6_1750099455084.png",[451,1487,1488],{},[454,1489,1484],{},[268,1491,1493],{"id":1492},"additional-approval-settings","Additional approval settings",[12,1495,1496],{},"There are additional approval settings that can be applied before code can be committed with a merge request. These additional approval settings are as follows:",[29,1498,1499,1502,1505,1508],{},[32,1500,1501],{},"prevent approval by author",[32,1503,1504],{},"prevent approvals by users who add commits",[32,1506,1507],{},"prevent editing approval rules in merge requests",[32,1509,1510],{},"require user re-authentication (password or SAML) to approve",[12,1512,1513],{},"Additionally, whenever a commit is added, you can:",[29,1515,1516,1519,1522],{},[32,1517,1518],{},"keep approvals",[32,1520,1521],{},"remove all approvals",[32,1523,1524],{},"remove approvals by Code Owners if their files changed",[12,1526,1527],{},[446,1528],{"alt":1529,"src":1530},"Additional Approval settings","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750099455/Blog/Content%20Images/Blog/Content%20Images/image12_aHR0cHM6_1750099455084.png",[451,1532,1533],{},[454,1534,1529],{},[12,1536,1537],{},"To configure additional approval settings you can perform the following steps:",[387,1539,1540,1545,1550,1557,1564],{},[32,1541,391,1542,1544],{},[35,1543,394],{}," and find your project.",[32,1546,408,1547,330],{},[35,1548,1549],{},"Settings > Merge requests",[32,1551,1552,1553,1556],{},"Scroll down to the ",[35,1554,1555],{},"Merge request approvals"," section.",[32,1558,1559,1560,1563],{},"Under ",[35,1561,1562],{},"Approval settings"," select the approval settings you would like\nto apply.",[32,1565,1181,1566,1185],{},[35,1567,1568],{},"Save changes",[12,1570,1571],{},"These can also be applied to your top-level group by performing the following steps:",[387,1573,1574,1579,1584,1589,1593],{},[32,1575,391,1576,1578],{},[35,1577,394],{}," and find your top-level\ngroup.",[32,1580,408,1581,330],{},[35,1582,1583],{},"Settings > General",[32,1585,1586,1587,1556],{},"Expand the ",[35,1588,1555],{},[32,1590,1559,1591,1563],{},[35,1592,1562],{},[32,1594,1181,1595,1185],{},[35,1596,1568],{},[12,1598,1599],{},"By leveraging these approval settings you can make sure that code always obtains oversight by a person who was not involved in creating the code, thereby preventing a conflict of interest.",[119,1601,1603],{"id":1602},"compliance-pipelines-and-frameworks","Compliance pipelines and frameworks",[12,1605,1606],{},"You can create a compliance framework that is a label to identify that your project has certain compliance requirements or needs additional oversight.\nThe label can optionally enforce compliance pipeline configuration to the projects on which it is applied.",[12,1608,1060,1609,1614],{},[16,1610,1613],{"href":1611,"rel":1612},"https://gitlab.com/gitlab-da/tutorials/security-and-governance/compliance-frameworks",[],"Compliance Frameworks\nDemo","\ngroup to see an example of compliance frameworks and their usage.",[268,1616,1618],{"id":1617},"create-a-compliance-pipeline","Create a compliance pipeline",[12,1620,1621,1622,1625],{},"To create a compliance pipeline, all you need to do is create a new project which will store a ",[513,1623,1624],{},".gitlab-ci.yml"," file that we wish to use in another project. The new compliance pipeline project can have separate permissions from the project to which you will apply it. This is beneficial because it prevents developers from making changes to pipelines that must run.",[12,1627,1628,1629,1633],{},"You can see I have created the following ",[16,1630,1632],{"href":1611,"rel":1631},[],"pipeline definition","\nwhich:",[29,1635,1636,1639,1642,1645],{},[32,1637,1638],{},"runs the SAST security scanner",[32,1640,1641],{},"runs the secret detection scanner",[32,1643,1644],{},"runs a SOC2 compliance job",[32,1646,1647],{},"runs the original pipeline defined in the project to which we will apply\nthis pipeline. This allows developers to focus on the actual application development and the compliance team to focus on defining the SOC2 rules.",[268,1649,1651],{"id":1650},"create-and-apply-a-compliance-framework","Create and apply a compliance framework",[12,1653,1654],{},"Now that the compliance pipeline for SOC2 has been defined, we must define a compliance framework and apply it to our project. In this case, I will apply it to my Accounting Department project.",[12,1656,1657],{},"To create a compliance framework label, follow these steps:",[387,1659,1660,1665,1669,1674,1680],{},[32,1661,391,1662,1664],{},[35,1663,394],{}," and find your group.",[32,1666,408,1667,330],{},[35,1668,1583],{},[32,1670,1586,1671,1556],{},[35,1672,1673],{},"Compliance frameworks",[32,1675,1676,1677,1185],{},"Click the ",[35,1678,1679],{},"Add framework",[32,1681,1682,1683],{},"Create a new compliance framework and populate the following sections:",[29,1684,1685,1690,1695,1701],{},[32,1686,1687,1689],{},[35,1688,1129],{}," The name of your compliance framework",[32,1691,1692,1694],{},[35,1693,1135],{}," A description of your compliance framework",[32,1696,1697,1700],{},[35,1698,1699],{},"Compliance pipeline configuration:"," The location of the compliance pipeline to run.",[32,1702,1703,1706],{},[35,1704,1705],{},"Background color:"," A color for the compliance framework label",[12,1708,1709],{},[446,1710],{"alt":1711,"src":1712},"PoLP - image 15","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750099455/Blog/Content%20Images/Blog/Content%20Images/image11_aHR0cHM6_1750099455085.png",[506,1714,1717],{"className":1715,"code":1716,"language":915},[913],"\u003Ccenter>\u003Cem>Creating a compliance framework\u003C/em>\u003C/center>\u003Cp>\u003C/p>\n",[513,1718,1716],{"__ignoreMap":511},[12,1720,1721,1722,1185],{},"6. Press the ",[35,1723,1679],{},[12,1725,1726],{},"And now you should see your newly added framework under active compliance frameworks.",[12,1728,1729],{},[446,1730],{"alt":1731,"src":1732},"Active compliance frameworks","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750099455/Blog/Content%20Images/Blog/Content%20Images/image9_aHR0cHM6_1750099455085.png",[451,1734,1735],{},[454,1736,1731],{},[12,1738,1739],{},"Now let’s go ahead and assign this compliance label to our Accounting\nDepartment project:",[387,1741,1742,1746,1750,1754],{},[32,1743,391,1744,1544],{},[35,1745,394],{},[32,1747,408,1748,330],{},[35,1749,1583],{},[32,1751,1371,1752,330],{},[35,1753,1673],{},[32,1755,1756],{},"Select the compliance framework created above.",[12,1758,1759],{},[446,1760],{"alt":1761,"src":1762},"Adding a compliance framework","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750099455/Blog/Content%20Images/Blog/Content%20Images/image4_aHR0cHM6_1750099455086.png",[451,1764,1765],{},[454,1766,1761],{},[387,1768,1769],{"start":556},[32,1770,408,1771,330],{},[35,1772,1568],{},[12,1774,1775],{},"The project should now have the compliance framework label applied.",[12,1777,1778],{},[446,1779],{"alt":1780,"src":1781},"Project running a compliance pipeline","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750099455/Blog/Content%20Images/Blog/Content%20Images/image10_aHR0cHM6_1750099455086.png",[451,1783,1784],{},[454,1785,1780],{},[12,1787,1788],{},"This enables separation of duties and prevents compliance pipelines from being altered by those without permissions.",[12,1790,1791],{},"Security Policy Scope and Pipeline Execution",[12,1793,1794],{},"Over the past several releases, GitLab has introduced two experimental features, Security Policy Scope and Pipeline Execution, to make it even easier to adhere to PoLP. These features are very similar to Compliance\nPipelines and Compliance Frameworks and can be managed from GitLab’s security policy UI.",[12,1796,1797,1800],{},[35,1798,1799],{},"Note:"," These features are currently considered experimental. An experiment is a feature that is in the process of being developed. It is not production ready. We encourage users to try experimental features and provide feedback.",[12,1802,1803],{},"The pipeline execution policy action\nintroduces a new scan action type into Scan Execution policies for creating and enforcing custom CI in your target development projects. You can execute a custom pipeline along with your current pipeline. This allows you to enforce compliance by always forcing particular actions to run that are not just security scanners and that cannot be overwritten by those without permissions.",[12,1805,1806],{},[446,1807],{"alt":1808,"src":1809},"Pipeline Execution policy scope selection","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750099455/Blog/Content%20Images/Blog/Content%20Images/image18_aHR0cHM6_1750099455087.png",[451,1811,1812],{},[454,1813,1814],{},"Pipeline Execution policy scope selection - insert code block",[12,1816,1817],{},[446,1818],{"alt":1808,"src":1819},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1750099455/Blog/Content%20Images/Blog/Content%20Images/image13_aHR0cHM6_1750099455087.png",[451,1821,1822],{},[454,1823,1824],{},"Pipeline Execution policy scope selection - link existing CI file",[12,1826,1827],{},"The Security policy scope\ncan be applied to either Merge Request Approval or Scan Execution policies.\nScopes enable you to administer policies with a particular scope, meaning you can:",[29,1829,1830,1833],{},[32,1831,1832],{},"Include only projects containing a compliance framework label",[32,1834,1835],{},"Include or exclude selected projects from enforcement",[12,1837,1838],{},"To enable these experimental features, follow these steps:",[387,1840,1841,1845,1849,1854,1859],{},[32,1842,391,1843,1578],{},[35,1844,394],{},[32,1846,408,1847,330],{},[35,1848,1583],{},[32,1850,1371,1851,330],{},[35,1852,1853],{},"Permissions and group features",[32,1855,1552,1856,1556],{},[35,1857,1858],{},"Security policy management",[32,1860,1861],{},"Select the following checkboxes",[12,1863,1864,1867],{},[35,1865,1866],{},"Security policy pipeline execution action:"," Create and enforce custom CI jobs and scripts using this new policy action.",[387,1869,1870,1876,1882,1887,1894],{"start":561},[32,1871,1872,1875],{},[35,1873,1874],{},"Security policy scopes:"," Granularly scope each policy you create to\nprojects containing a compliance framework label, or a list of projects.",[32,1877,1878,1881],{},[35,1879,1880],{},"Enforce for all subgroups (optional):"," Subgroups cannot change these\nsettings.",[32,1883,1552,1884,1556],{},[35,1885,1886],{},"Experiment and Beta features",[32,1888,1889,1890,1893],{},"Select the ",[35,1891,1892],{},"Use Experiment and Beta features"," checkbox.",[32,1895,1896,1897,1185],{},"Scroll down and press the ",[35,1898,1568],{},[12,1900,1901],{},"Now, whenever you are creating a security policy, the following options will be available:",[29,1903,1904,1907,1910,1913,1916,1919],{},[32,1905,1906],{},"Inserting a CI code block (Scan Execution policy only)",[32,1908,1909],{},"Loading CI/CD code from file (Scan Execution policy only)",[32,1911,1912],{},"Linking an existing CI file from another project (Scan Execution policy\nonly)",[32,1914,1915],{},"Scoping a policy to projects with selected compliance framework (Group\nLevel only)",[32,1917,1918],{},"Scoping a policy towards specific projects (Group Level only)",[32,1920,1921],{},"Scoping a policy towards all projects in group (Group Level only)",[12,1923,1924],{},"To learn more about these features, check out the following documentation:",[29,1926,1927,1930,1933],{},[32,1928,1929],{},"Pipeline Execution Policy action (Scan Execution\npolicy)",[32,1931,1932],{},"Security Policy Scopes (Scan Execution\npolicy)",[32,1934,1935],{},"Security Policy Scopes (Merge Request Approval\npolicy)",[119,1937,1939],{"id":1938},"additional-resources","Additional resources",[12,1941,1942],{},"Thanks for reading! These are some of the ways that GitLab allows you to strengthen your organization's security posture through the enablement of\nPoLP. To learn more about GitLab and the other ways we can strengthen your organization's security throughout all parts of the SDLC, check out the following links:",[29,1944,1945,1952,1959,1965,1971,1978,1984,1990,1993,1999],{},[32,1946,1947],{},[16,1948,1951],{"href":1949,"rel":1950},"https://about.gitlab.com/solutions/application-security-testing/",[],"GitLab Security and\nCompliance",[32,1953,1954],{},[16,1955,1958],{"href":1956,"rel":1957},"https://docs.gitlab.com/user/application_security/",[],"GitLab Application Security\nDocumentation",[32,1960,1961],{},[16,1962,1964],{"href":1063,"rel":1963},[],"GitLab DevSecOps Demo\nProject",[32,1966,1967],{},[16,1968,1970],{"href":1069,"rel":1969},[],"GitLab DevSecOps\nTutorial",[32,1972,1973],{},[16,1974,1977],{"href":1975,"rel":1976},"https://docs.gitlab.com/user/permissions/",[],"GitLab Roles and Permissions\nDocumentation",[32,1979,1980],{},[16,1981,1983],{"href":128,"rel":1982},[],"GitLab Custom Roles\nDocumentation",[32,1985,1986],{},[16,1987,1989],{"href":1006,"rel":1988},[],"GitLab Security Policies\nDocumentation",[32,1991,1992],{},"GitLab Compliance Frameworks\nDocumentation",[32,1994,1995],{},[16,1996,1998],{"href":1438,"rel":1997},[],"GitLab Code Owners\nDocumentation",[32,2000,2001],{},[16,2002,2004],{"href":1326,"rel":2003},[],"GitLab Branch Protections\nDocumentation",[2006,2007,2008],"style",{},"html pre.shiki code .s7eDp, html code.shiki .s7eDp{--shiki-default:#6F42C1}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sYu0t, html code.shiki .sYu0t{--shiki-default:#005CC5}",{"title":511,"searchDepth":526,"depth":526,"links":2010},[2011,2016,2020,2025,2029],{"id":121,"depth":526,"text":122,"children":2012},[2013,2014,2015],{"id":270,"depth":492,"text":271},{"id":333,"depth":492,"text":334},{"id":381,"depth":492,"text":382},{"id":1000,"depth":526,"text":79,"children":2017},[2018,2019],{"id":1074,"depth":492,"text":1075},{"id":1191,"depth":492,"text":1192},{"id":1320,"depth":526,"text":1321,"children":2021},[2022,2023,2024],{"id":1352,"depth":492,"text":1353},{"id":1431,"depth":492,"text":1432},{"id":1492,"depth":492,"text":1493},{"id":1602,"depth":526,"text":1603,"children":2026},[2027,2028],{"id":1617,"depth":492,"text":1618},{"id":1650,"depth":492,"text":1651},{"id":1938,"depth":526,"text":1939},"security","2024-03-06","This tutorial demonstrates how to achieve least privilege access using custom roles, security policies, compliance pipelines, branch protections, and more.","md",null,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1750099438/Blog/Hero%20Images/Blog/Hero%20Images/built-in-security_built-in-security.jpeg_1750099438377.jpg",{},"/en-us/blog/the-ultimate-guide-to-least-privilege-access-with-gitlab",{"ogTitle":5,"ogImage":2035,"ogDescription":2032,"ogSiteName":2039,"noIndex":2040,"ogType":2041,"ogUrl":2042,"title":5,"canonicalUrls":2042,"description":2032},"https://about.gitlab.com",false,"article","https://about.gitlab.com/blog/the-ultimate-guide-to-least-privilege-access-with-gitlab","the-ultimate-guide-to-least-privilege-access-with-gitlab","en-us/blog/the-ultimate-guide-to-least-privilege-access-with-gitlab",[2046,2047,2030,2048],"zero trust","tutorial","features","BlogPost","Z4qBlsWswvoNX04CMoaPsnLXxAjbxzhnHekLkcb4Mtw",{"logo":2052,"freeTrial":2057,"sales":2062,"login":2067,"items":2072,"search":2399,"minimal":2430,"duo":2449,"switchNav":2458,"pricingDeployment":2469},{"config":2053},{"href":2054,"dataGaName":2055,"dataGaLocation":2056},"/","gitlab logo","header",{"text":2058,"config":2059},"Get free trial",{"href":2060,"dataGaName":2061,"dataGaLocation":2056},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":2063,"config":2064},"Request a demo",{"href":2065,"dataGaName":2066,"dataGaLocation":2056},"/sales/?contact-topic=request-demo","sales",{"text":2068,"config":2069},"Sign in",{"href":2070,"dataGaName":2071,"dataGaLocation":2056},"https://gitlab.com/users/sign_in/","sign in",[2073,2102,2202,2207,2321,2377],{"text":2074,"config":2075,"menu":2077},"Platform",{"dataNavLevelOne":2076},"platform",{"type":2078,"columns":2079},"cards",[2080,2086,2094],{"title":2074,"description":2081,"link":2082},"The intelligent orchestration platform for DevSecOps",{"text":2083,"config":2084},"Explore our Platform",{"href":2085,"dataGaName":2076,"dataGaLocation":2056},"/platform/",{"title":2087,"description":2088,"link":2089},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":2090,"config":2091},"Meet GitLab Duo",{"href":2092,"dataGaName":2093,"dataGaLocation":2056},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":2095,"description":2096,"link":2097},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":2098,"config":2099},"Learn more",{"href":2100,"dataGaName":2101,"dataGaLocation":2056},"/why-gitlab/","why gitlab",{"text":2103,"left":522,"config":2104,"menu":2106},"Product",{"dataNavLevelOne":2105},"solutions",{"type":2107,"link":2108,"columns":2112,"feature":2181},"lists",{"text":2109,"config":2110},"View all Solutions",{"href":2111,"dataGaName":2105,"dataGaLocation":2056},"/solutions/",[2113,2137,2160],{"title":2114,"description":2115,"link":2116,"items":2121},"Automation","CI/CD and automation to accelerate deployment",{"config":2117},{"icon":2118,"href":2119,"dataGaName":2120,"dataGaLocation":2056},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[2122,2126,2129,2133],{"text":2123,"config":2124},"CI/CD",{"href":2125,"dataGaLocation":2056,"dataGaName":2123},"/solutions/continuous-integration/",{"text":2087,"config":2127},{"href":2092,"dataGaLocation":2056,"dataGaName":2128},"gitlab duo agent platform - product menu",{"text":2130,"config":2131},"Source Code Management",{"href":2132,"dataGaLocation":2056,"dataGaName":2130},"/solutions/source-code-management/",{"text":2134,"config":2135},"Automated Software Delivery",{"href":2119,"dataGaLocation":2056,"dataGaName":2136},"Automated software delivery",{"title":2138,"description":2139,"link":2140,"items":2145},"Security","Deliver code faster without compromising security",{"config":2141},{"href":2142,"dataGaName":2143,"dataGaLocation":2056,"icon":2144},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[2146,2150,2155],{"text":2147,"config":2148},"Application Security Testing",{"href":2142,"dataGaName":2149,"dataGaLocation":2056},"Application security testing",{"text":2151,"config":2152},"Software Supply Chain Security",{"href":2153,"dataGaLocation":2056,"dataGaName":2154},"/solutions/supply-chain/","Software supply chain security",{"text":2156,"config":2157},"Software Compliance",{"href":2158,"dataGaName":2159,"dataGaLocation":2056},"/solutions/software-compliance/","software compliance",{"title":2161,"link":2162,"items":2167},"Measurement",{"config":2163},{"icon":2164,"href":2165,"dataGaName":2166,"dataGaLocation":2056},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[2168,2172,2176],{"text":2169,"config":2170},"Visibility & Measurement",{"href":2165,"dataGaLocation":2056,"dataGaName":2171},"Visibility and Measurement",{"text":2173,"config":2174},"Value Stream Management",{"href":2175,"dataGaLocation":2056,"dataGaName":2173},"/solutions/value-stream-management/",{"text":2177,"config":2178},"Analytics & Insights",{"href":2179,"dataGaLocation":2056,"dataGaName":2180},"/solutions/analytics-and-insights/","Analytics and insights",{"title":2182,"type":2107,"items":2183},"GitLab for",[2184,2190,2196],{"text":2185,"config":2186},"Enterprise",{"icon":2187,"href":2188,"dataGaLocation":2056,"dataGaName":2189},"Building","/enterprise/","enterprise",{"text":2191,"config":2192},"Small Business",{"icon":2193,"href":2194,"dataGaLocation":2056,"dataGaName":2195},"Work","/small-business/","small business",{"text":2197,"config":2198},"Public Sector",{"icon":2199,"href":2200,"dataGaLocation":2056,"dataGaName":2201},"Organization","/solutions/public-sector/","public sector",{"text":2203,"config":2204},"Pricing",{"href":2205,"dataGaName":2206,"dataGaLocation":2056,"dataNavLevelOne":2206},"/pricing/","pricing",{"text":2208,"config":2209,"menu":2211},"Resources",{"dataNavLevelOne":2210},"resources",{"type":2107,"link":2212,"columns":2216,"feature":2310},{"text":2213,"config":2214},"View all resources",{"href":2215,"dataGaName":2210,"dataGaLocation":2056},"/resources/",[2217,2250,2277],{"title":2218,"items":2219},"Getting started",[2220,2225,2230,2235,2240,2245],{"text":2221,"config":2222},"Install",{"href":2223,"dataGaName":2224,"dataGaLocation":2056},"/install/","install",{"text":2226,"config":2227},"Quick start guides",{"href":2228,"dataGaName":2229,"dataGaLocation":2056},"/get-started/","quick setup checklists",{"text":2231,"config":2232},"Learn",{"href":2233,"dataGaLocation":2056,"dataGaName":2234},"https://university.gitlab.com/","learn",{"text":2236,"config":2237},"Product documentation",{"href":2238,"dataGaName":2239,"dataGaLocation":2056},"https://docs.gitlab.com/","product documentation",{"text":2241,"config":2242},"Best practice videos",{"href":2243,"dataGaName":2244,"dataGaLocation":2056},"/getting-started-videos/","best practice videos",{"text":2246,"config":2247},"Integrations",{"href":2248,"dataGaName":2249,"dataGaLocation":2056},"/integrations/","integrations",{"title":2251,"items":2252},"Discover",[2253,2258,2263,2268,2272],{"text":2254,"config":2255},"Customer success stories",{"href":2256,"dataGaName":2257,"dataGaLocation":2056},"/customers/","customer success stories",{"text":2259,"config":2260},"Blog",{"href":2261,"dataGaName":2262,"dataGaLocation":2056},"/blog/","blog",{"text":2264,"config":2265},"Demo Hub",{"href":2266,"dataGaName":2267,"dataGaLocation":2056},"/demo-hub/","demo hub",{"text":2269,"config":2270},"The Source",{"href":2271,"dataGaName":2262,"dataGaLocation":2056},"/the-source/",{"text":2273,"config":2274},"Remote",{"href":2275,"dataGaName":2276,"dataGaLocation":2056},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":2278,"items":2279},"Connect",[2280,2285,2290,2295,2300,2305],{"text":2281,"config":2282},"GitLab Services",{"href":2283,"dataGaName":2284,"dataGaLocation":2056},"/services/","services",{"text":2286,"config":2287},"Contribute",{"href":2288,"dataGaName":2289,"dataGaLocation":2056},"https://contributors.gitlab.com","contribute",{"text":2291,"config":2292},"Community",{"href":2293,"dataGaName":2294,"dataGaLocation":2056},"/community/","community",{"text":2296,"config":2297},"Forum",{"href":2298,"dataGaName":2299,"dataGaLocation":2056},"https://forum.gitlab.com/","forum",{"text":2301,"config":2302},"Events",{"href":2303,"dataGaName":2304,"dataGaLocation":2056},"/events/","events",{"text":2306,"config":2307},"Partners",{"href":2308,"dataGaName":2309,"dataGaLocation":2056},"/partners/","partners",{"config":2311,"title":2314,"text":2315,"link":2316},{"background":2312,"textColor":2313},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":2317,"config":2318},"Read the latest",{"href":2319,"dataGaName":2320,"dataGaLocation":2056},"/whats-new/","whats new",{"text":2322,"config":2323,"menu":2325},"Company",{"dataNavLevelOne":2324},"company",{"type":2107,"columns":2326},[2327],{"items":2328},[2329,2334,2340,2342,2347,2352,2357,2362,2367,2372],{"text":2330,"config":2331},"About",{"href":2332,"dataGaName":2333,"dataGaLocation":2056},"/company/","about",{"text":2335,"config":2336,"footerGa":2339},"Jobs",{"href":2337,"dataGaName":2338,"dataGaLocation":2056},"/jobs/","jobs",{"dataGaName":2338},{"text":2301,"config":2341},{"href":2303,"dataGaName":2304,"dataGaLocation":2056},{"text":2343,"config":2344},"Leadership",{"href":2345,"dataGaName":2346,"dataGaLocation":2056},"/company/team/e-group/","leadership",{"text":2348,"config":2349},"Handbook",{"href":2350,"dataGaName":2351,"dataGaLocation":2056},"https://handbook.gitlab.com/","handbook",{"text":2353,"config":2354},"Investor relations",{"href":2355,"dataGaName":2356,"dataGaLocation":2056},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":2358,"config":2359},"Trust Center",{"href":2360,"dataGaName":2361,"dataGaLocation":2056},"/security/","trust center",{"text":2363,"config":2364},"AI Transparency Center",{"href":2365,"dataGaName":2366,"dataGaLocation":2056},"/ai-transparency-center/","ai transparency center",{"text":2368,"config":2369},"Newsletter",{"href":2370,"dataGaName":2371,"dataGaLocation":2056},"/company/contact/#contact-forms","newsletter",{"text":2373,"config":2374},"Press",{"href":2375,"dataGaName":2376,"dataGaLocation":2056},"/press/","press",{"text":2378,"config":2379,"menu":2380},"Contact us",{"dataNavLevelOne":2324},{"type":2107,"columns":2381},[2382],{"items":2383},[2384,2389,2394],{"text":2385,"config":2386},"Talk to sales",{"href":2387,"dataGaName":2388,"dataGaLocation":2056},"/sales/","talk to sales",{"text":2390,"config":2391},"Support portal",{"href":2392,"dataGaName":2393,"dataGaLocation":2056},"https://support.gitlab.com/hc/en-us","support portal",{"text":2395,"config":2396},"Customer portal",{"href":2397,"dataGaName":2398,"dataGaLocation":2056},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":2400,"login":2401,"suggestions":2408},"Close",{"text":2402,"link":2403},"To search repositories and projects, login to",{"text":2404,"config":2405},"gitlab.com",{"href":2070,"dataGaName":2406,"dataGaLocation":2407},"search login","search",{"text":2409,"default":2410},"Suggestions",[2411,2413,2417,2419,2423,2427],{"text":2087,"config":2412},{"href":2092,"dataGaName":2087,"dataGaLocation":2407},{"text":2414,"config":2415},"Code Suggestions (AI)",{"href":2416,"dataGaName":2414,"dataGaLocation":2407},"/solutions/code-suggestions/",{"text":2123,"config":2418},{"href":2125,"dataGaName":2123,"dataGaLocation":2407},{"text":2420,"config":2421},"GitLab on AWS",{"href":2422,"dataGaName":2420,"dataGaLocation":2407},"/partners/technology-partners/aws/",{"text":2424,"config":2425},"GitLab on Google Cloud",{"href":2426,"dataGaName":2424,"dataGaLocation":2407},"/partners/technology-partners/google-cloud-platform/",{"text":2428,"config":2429},"Why GitLab?",{"href":2100,"dataGaName":2428,"dataGaLocation":2407},{"freeTrial":2431,"mobileIcon":2436,"desktopIcon":2441,"secondaryButton":2444},{"text":2432,"config":2433},"Start free trial",{"href":2434,"dataGaName":2061,"dataGaLocation":2435},"https://gitlab.com/-/trials/new/","nav",{"altText":2437,"config":2438},"Gitlab Icon",{"src":2439,"dataGaName":2440,"dataGaLocation":2435},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":2437,"config":2442},{"src":2443,"dataGaName":2440,"dataGaLocation":2435},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":2445,"config":2446},"Get Started",{"href":2447,"dataGaName":2448,"dataGaLocation":2435},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":2450,"mobileIcon":2454,"desktopIcon":2456},{"text":2451,"config":2452},"Learn more about GitLab Duo",{"href":2092,"dataGaName":2453,"dataGaLocation":2435},"gitlab duo",{"altText":2437,"config":2455},{"src":2439,"dataGaName":2440,"dataGaLocation":2435},{"altText":2437,"config":2457},{"src":2443,"dataGaName":2440,"dataGaLocation":2435},{"button":2459,"mobileIcon":2464,"desktopIcon":2466},{"text":2460,"config":2461},"/switch",{"href":2462,"dataGaName":2463,"dataGaLocation":2435},"#contact","switch",{"altText":2437,"config":2465},{"src":2439,"dataGaName":2440,"dataGaLocation":2435},{"altText":2437,"config":2467},{"src":2468,"dataGaName":2440,"dataGaLocation":2435},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":2470,"mobileIcon":2475,"desktopIcon":2477},{"text":2471,"config":2472},"Back to pricing",{"href":2205,"dataGaName":2473,"dataGaLocation":2435,"icon":2474},"back to pricing","GoBack",{"altText":2437,"config":2476},{"src":2439,"dataGaName":2440,"dataGaLocation":2435},{"altText":2437,"config":2478},{"src":2443,"dataGaName":2440,"dataGaLocation":2435},{"title":2480,"titleMobile":2481,"button":2482,"config":2487},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":2098,"config":2483},{"href":2484,"dataGaName":2485,"dataGaLocation":2486},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":2488,"disabled":2040},"release",{"data":2490},{"text":2491,"source":2492,"edit":2498,"contribute":2503,"config":2508,"items":2513,"minimal":2723},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":2493,"config":2494},"View page source",{"href":2495,"dataGaName":2496,"dataGaLocation":2497},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":2499,"config":2500},"Edit this page",{"href":2501,"dataGaName":2502,"dataGaLocation":2497},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":2504,"config":2505},"Please contribute",{"href":2506,"dataGaName":2507,"dataGaLocation":2497},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":2509,"facebook":2510,"youtube":2511,"linkedin":2512},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[2514,2561,2615,2659,2691],{"title":2203,"links":2515,"subMenu":2530},[2516,2520,2525],{"text":2517,"config":2518},"View plans",{"href":2205,"dataGaName":2519,"dataGaLocation":2497},"view plans",{"text":2521,"config":2522},"Why Premium?",{"href":2523,"dataGaName":2524,"dataGaLocation":2497},"/pricing/premium/","why premium",{"text":2526,"config":2527},"Why Ultimate?",{"href":2528,"dataGaName":2529,"dataGaLocation":2497},"/pricing/ultimate/","why ultimate",[2531],{"title":2532,"links":2533},"Contact Us",[2534,2537,2539,2541,2546,2551,2556],{"text":2535,"config":2536},"Contact sales",{"href":2387,"dataGaName":2066,"dataGaLocation":2497},{"text":2390,"config":2538},{"href":2392,"dataGaName":2393,"dataGaLocation":2497},{"text":2395,"config":2540},{"href":2397,"dataGaName":2398,"dataGaLocation":2497},{"text":2542,"config":2543},"Status",{"href":2544,"dataGaName":2545,"dataGaLocation":2497},"https://status.gitlab.com/","status",{"text":2547,"config":2548},"Terms of use",{"href":2549,"dataGaName":2550,"dataGaLocation":2497},"/terms/","terms of use",{"text":2552,"config":2553},"Privacy statement",{"href":2554,"dataGaName":2555,"dataGaLocation":2497},"/privacy/","privacy statement",{"text":2557,"config":2558},"Cookie preferences",{"dataGaName":2559,"dataGaLocation":2497,"id":2560,"isOneTrustButton":522},"cookie preferences","ot-sdk-btn",{"title":2103,"links":2562,"subMenu":2571},[2563,2567],{"text":2564,"config":2565},"DevSecOps platform",{"href":2085,"dataGaName":2566,"dataGaLocation":2497},"devsecops platform",{"text":2568,"config":2569},"AI-Assisted Development",{"href":2092,"dataGaName":2570,"dataGaLocation":2497},"ai-assisted development",[2572],{"title":2573,"links":2574},"Topics",[2575,2580,2585,2590,2595,2600,2605,2610],{"text":2576,"config":2577},"CICD",{"href":2578,"dataGaName":2579,"dataGaLocation":2497},"/topics/ci-cd/","cicd",{"text":2581,"config":2582},"GitOps",{"href":2583,"dataGaName":2584,"dataGaLocation":2497},"/topics/gitops/","gitops",{"text":2586,"config":2587},"DevOps",{"href":2588,"dataGaName":2589,"dataGaLocation":2497},"/topics/devops/","devops",{"text":2591,"config":2592},"Version Control",{"href":2593,"dataGaName":2594,"dataGaLocation":2497},"/topics/version-control/","version control",{"text":2596,"config":2597},"DevSecOps",{"href":2598,"dataGaName":2599,"dataGaLocation":2497},"/topics/devsecops/","devsecops",{"text":2601,"config":2602},"Cloud Native",{"href":2603,"dataGaName":2604,"dataGaLocation":2497},"/topics/cloud-native/","cloud native",{"text":2606,"config":2607},"AI for Coding",{"href":2608,"dataGaName":2609,"dataGaLocation":2497},"/topics/devops/ai-for-coding/","ai for coding",{"text":2611,"config":2612},"Agentic AI",{"href":2613,"dataGaName":2614,"dataGaLocation":2497},"/topics/agentic-ai/","agentic ai",{"title":2616,"links":2617},"Solutions",[2618,2620,2622,2627,2631,2634,2638,2641,2643,2646,2649,2654],{"text":2147,"config":2619},{"href":2142,"dataGaName":2147,"dataGaLocation":2497},{"text":2136,"config":2621},{"href":2119,"dataGaName":2120,"dataGaLocation":2497},{"text":2623,"config":2624},"Agile development",{"href":2625,"dataGaName":2626,"dataGaLocation":2497},"/solutions/agile-delivery/","agile delivery",{"text":2628,"config":2629},"SCM",{"href":2132,"dataGaName":2630,"dataGaLocation":2497},"source code management",{"text":2576,"config":2632},{"href":2125,"dataGaName":2633,"dataGaLocation":2497},"continuous integration & delivery",{"text":2635,"config":2636},"Value stream management",{"href":2175,"dataGaName":2637,"dataGaLocation":2497},"value stream management",{"text":2581,"config":2639},{"href":2640,"dataGaName":2584,"dataGaLocation":2497},"/solutions/gitops/",{"text":2185,"config":2642},{"href":2188,"dataGaName":2189,"dataGaLocation":2497},{"text":2644,"config":2645},"Small business",{"href":2194,"dataGaName":2195,"dataGaLocation":2497},{"text":2647,"config":2648},"Public sector",{"href":2200,"dataGaName":2201,"dataGaLocation":2497},{"text":2650,"config":2651},"Education",{"href":2652,"dataGaName":2653,"dataGaLocation":2497},"/solutions/education/","education",{"text":2655,"config":2656},"Financial services",{"href":2657,"dataGaName":2658,"dataGaLocation":2497},"/solutions/finance/","financial services",{"title":2208,"links":2660},[2661,2663,2665,2667,2670,2672,2675,2677,2679,2681,2683,2685,2687,2689],{"text":2221,"config":2662},{"href":2223,"dataGaName":2224,"dataGaLocation":2497},{"text":2226,"config":2664},{"href":2228,"dataGaName":2229,"dataGaLocation":2497},{"text":2231,"config":2666},{"href":2233,"dataGaName":2234,"dataGaLocation":2497},{"text":2236,"config":2668},{"href":2238,"dataGaName":2669,"dataGaLocation":2497},"docs",{"text":2259,"config":2671},{"href":2261,"dataGaName":2262,"dataGaLocation":2497},{"text":2673,"config":2674},"What's new",{"href":2319,"dataGaName":2320,"dataGaLocation":2497},{"text":2254,"config":2676},{"href":2256,"dataGaName":2257,"dataGaLocation":2497},{"text":2273,"config":2678},{"href":2275,"dataGaName":2276,"dataGaLocation":2497},{"text":2281,"config":2680},{"href":2283,"dataGaName":2284,"dataGaLocation":2497},{"text":2286,"config":2682},{"href":2288,"dataGaName":2289,"dataGaLocation":2497},{"text":2291,"config":2684},{"href":2293,"dataGaName":2294,"dataGaLocation":2497},{"text":2296,"config":2686},{"href":2298,"dataGaName":2299,"dataGaLocation":2497},{"text":2301,"config":2688},{"href":2303,"dataGaName":2304,"dataGaLocation":2497},{"text":2306,"config":2690},{"href":2308,"dataGaName":2309,"dataGaLocation":2497},{"title":2322,"links":2692},[2693,2695,2697,2699,2701,2703,2707,2712,2714,2716,2718],{"text":2330,"config":2694},{"href":2332,"dataGaName":2324,"dataGaLocation":2497},{"text":2335,"config":2696},{"href":2337,"dataGaName":2338,"dataGaLocation":2497},{"text":2343,"config":2698},{"href":2345,"dataGaName":2346,"dataGaLocation":2497},{"text":2348,"config":2700},{"href":2350,"dataGaName":2351,"dataGaLocation":2497},{"text":2353,"config":2702},{"href":2355,"dataGaName":2356,"dataGaLocation":2497},{"text":2704,"config":2705},"Sustainability",{"href":2706,"dataGaName":2704,"dataGaLocation":2497},"/sustainability/",{"text":2708,"config":2709},"Diversity, inclusion and belonging (DIB)",{"href":2710,"dataGaName":2711,"dataGaLocation":2497},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":2358,"config":2713},{"href":2360,"dataGaName":2361,"dataGaLocation":2497},{"text":2368,"config":2715},{"href":2370,"dataGaName":2371,"dataGaLocation":2497},{"text":2373,"config":2717},{"href":2375,"dataGaName":2376,"dataGaLocation":2497},{"text":2719,"config":2720},"Modern Slavery Transparency Statement",{"href":2721,"dataGaName":2722,"dataGaLocation":2497},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":2724},[2725,2728,2731],{"text":2726,"config":2727},"Terms",{"href":2549,"dataGaName":2550,"dataGaLocation":2497},{"text":2729,"config":2730},"Cookies",{"dataGaName":2559,"dataGaLocation":2497,"id":2560,"isOneTrustButton":522},{"text":2732,"config":2733},"Privacy",{"href":2554,"dataGaName":2555,"dataGaLocation":2497},[2735],{"id":2736,"title":7,"body":2034,"config":2737,"content":2739,"description":2034,"extension":2743,"meta":2744,"navigation":522,"path":2745,"seo":2746,"stem":2747,"__hash__":2748},"blogAuthors/en-us/blog/authors/fernando-diaz.yml",{"template":2738},"BlogAuthor",{"name":7,"config":2740},{"headshot":2741,"ctfId":2742},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659556/Blog/Author%20Headshots/fern_diaz.png","fjdiaz","yml",{},"/en-us/blog/authors/fernando-diaz",{},"en-us/blog/authors/fernando-diaz","lxRJIOydP4_yzYZvsPcuQevP9AYAKREF7i8QmmdnOWc",[2750,2758,2766],{"title":2751,"description":2752,"heroImage":2753,"category":2030,"date":2754,"authors":2755,"slug":2757,"externalUrl":2034},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[2756],"Julian Thome","improved-scope-offset-fingerprinting",{"title":2759,"description":2760,"heroImage":2753,"category":2030,"date":2761,"authors":2762,"slug":2765,"externalUrl":2034},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[2763,2764],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":2767,"description":2768,"heroImage":2769,"category":2030,"date":2770,"authors":2771,"slug":2773,"externalUrl":2034},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[2772],"Alisa Ho","claude-security-and-gitlab",{"promotions":2775},[2776,2790,2802,2813],{"id":2777,"categories":2778,"header":2780,"text":2781,"button":2782,"image":2787},"ai-modernization",[2779],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":2783,"config":2784},"Get your AI maturity score",{"href":2785,"dataGaName":2786,"dataGaLocation":2262},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":2788},{"src":2789},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":2791,"categories":2792,"header":2794,"text":2781,"button":2795,"image":2799},"devops-modernization",[2793,2599],"product","Are you just managing tools or shipping innovation?",{"text":2796,"config":2797},"Get your DevOps maturity score",{"href":2798,"dataGaName":2786,"dataGaLocation":2262},"/assessments/devops-modernization-assessment/",{"config":2800},{"src":2801},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":2803,"categories":2804,"header":2805,"text":2781,"button":2806,"image":2810},"security-modernization",[2030],"Are you trading speed for security?",{"text":2807,"config":2808},"Get your security maturity score",{"href":2809,"dataGaName":2786,"dataGaLocation":2262},"/assessments/security-modernization-assessment/",{"config":2811},{"src":2812},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":2814,"paths":2815,"header":2818,"text":2819,"button":2820,"image":2825},"github-azure-migration",[2816,2817],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":2821,"config":2822},"See how GitLab compares to GitHub",{"href":2823,"dataGaName":2824,"dataGaLocation":2262},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":2826},{"src":2801},{"header":2828,"blurb":2829,"button":2830,"secondaryButton":2835},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":2831,"config":2832},"Get your free trial",{"href":2833,"dataGaName":2061,"dataGaLocation":2834},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":2535,"config":2836},{"href":2387,"dataGaName":2066,"dataGaLocation":2834},1786803766256]