An Auditor Asked Who Approved a Change Our Pipeline Made

说明与用途

CI/CD流水线在执行时记录变更元数据（提交、审查者、检查、目标），满足审计要求，同时保持自动化优势。

问题

Internal audit required approval records for production changes, but automated pipeline changes had no human approval record.

结果

Audit compliance achieved by moving evidence generation into the pipeline, eliminating the need for manual approval tickets and preserving automation efficiency.

工作流

• 1. Identify automated change classes (e.g., firewall rule updates, scaling policy adjustments, certificate renewals).
• 2. Configure pipeline to capture execution metadata: commit hash, merge request reviewers, automated policy check results, and affected resources.
• 3. Emit a change record (e.g., JSON or database entry) at the moment the pipeline applies the change.
• 4. Store records in an audit‑ready repository or logging system.
• 5. For manual elevated‑rights jobs, generate a separate, more detailed record and schedule weekly review.
• 6. Provide auditors with access to the change record repository instead of traditional approval forms.

证据

The pipeline now writes the change record itself, at the moment it acts, carrying the commit, the reviewers, the checks that passed, what it changed and where.

来源

Automation does not remove the need for a control. It moves the control earlier, into the review and the definition, and it leaves the organisation with a governance process still watching the place where the work used to happen.

来源