AWS inspector medium security documentation change
Summary
Reduced required scopes for GitLab personal access tokens from including 'write_repository' to only 'api', 'read_api', and 'read_repository'
Security assessment
This change explicitly reduces permissions for AWS Inspector's GitLab integration by removing the 'write_repository' scope. This follows the principle of least privilege and directly addresses a potential security weakness where excessive write permissions could be exploited if tokens were compromised. The specific removal of a powerful scope constitutes concrete evidence of security hardening.
Diff
diff --git a/inspector/latest/user/code-security-assessments-connect-gitlab.md b/inspector/latest/user/code-security-assessments-connect-gitlab.md index 01b14345b..68b973111 100644 --- a//inspector/latest/user/code-security-assessments-connect-gitlab.md +++ b//inspector/latest/user/code-security-assessments-connect-gitlab.md @@ -21 +21 @@ The following is required when you create a connection: - * Personal access token – The personal access token is [created in GitLab Self Managed](https://docs.gitlab.com/user/profile/personal_access_tokens/) from an administrator account and must include the following scopes: `api`, `read_api`, `read_repository`, and `write_repository`. + * Personal access token – The personal access token is [created in GitLab Self Managed](https://docs.gitlab.com/user/profile/personal_access_tokens/) from an administrator account and must include the following scopes: `api`, `read_api`, and `read_repository`.