Scan GitLab for secrets

Connect GitLab as a data source to HCP Vault Radar to scan your GitLab repositories for sensitive data and secrets. Vault Radar supports scanning GitLab Cloud and GitLab Self-Managed.

If you are new to HCP Vault Radar, checkout the HCP Vault Radar quickstart series.

Prerequisites

HCP IAM user with the HCP owner, or admin role
Vault Radar agent deployed and running (for agent scan)
GitLab personal access token with the required permission scopes:
```
api
read_api
```

Add a GitLab data source

You can add and scan GitLab Cloud or GitLab Self-Managed using the HCP Vault Radar cloud scan or HCP Vault Radar agent scan.

Note

Vault Radar has a limit of 5000 repositories per connection. If you have more than 5000 repositories, Vault Radar will select the 5000 repositories with the most recent activity.

Add GitLab Cloud as a data source to scan your GitLab group's repositories for secrets.

Log into the HCP Portal with an HCP IAM user that has the HCP owner or admin role.
Click Vault Radar.
Click Settings.
Click Data Source Hosts.
Click Add data source host.
Select HCP Vault Radar Scan.
Select GitLab Cloud.
Enter the personal access token in the Enter your GitLab personal access token field.
Click Next.
Select either All data sources or Select data sources.
Click Finish.

Log into the HCP Portal with an HCP IAM user that has the HCP owner or admin role.
Click Vault Radar.
Click Settings.
Click Data Source Hosts.
Click Add data source host.
Select Vault Radar Agent Scan.
Select GitLab Cloud.
Enter the path to the environment variable with the personal access token in the Enter environment path to your GitLab personal access token field.
Example:
```
env://GITLAB_TOKEN
```
Click Next.
Select either All data sources or Select data sources.
Click Finish.

Add GitLab Self-Managed as a data source to scan your GitLab group's repositories for secrets.

Log into the HCP Portal with an HCP IAM user that has the HCP owner or admin role.
Click Vault Radar.
Click Settings.
Click Data Source Hosts.
Click Add data source host.
Select HCP Vault Radar Scan.
Select GitLab Self-Managed.
Enter the following information:
- Enter your GitLab domain name: Fully qualified domain name of your GitLab Self-Managed.
- Enter your GitLab personal access token: Access token from your GitLab Self-Managed.
Click Next.
Select either All data sources or Select data sources.
Click Finish.

Log into the HCP Portal with an HCP IAM user that has the HCP owner or admin role.
Click Vault Radar.
Click Settings.
Click Data Source Hosts.
Click Add data source host.
Select Vault Radar Agent Scan.
Select GitLab Self-Managed .
Enter the following information:
- Enter your GitLab domain name: Fully qualified domain name of your GitLab Self-Managed.
- Enter environment path to your GitLab personal access token: Access token from your GitLab Self-Managed.
Example:
```
env://GITLAB_TOKEN
```
Click Next.
Select either All data sources or Select data sources.
Click Finish.

Assign a group to a resource

Once you add a data source, an HCP user with the admin role must assign a group to each of the monitored resources within each data source. You can assign each resource to only one group.

Note

Users with the HCP IAM admin role do not need to be a member of other groups. Accounts with the admin role have full access to Vault Radar.

If you do not already have a group, refer to the Identity and Access Management groups documentation to create a group.

Navigate to the Project dashboard.
Click Access control (IAM).
Click Add new assignment.
Search the name of the group in the Search for an assignee search field.
Click the group name in the search results.
Click the Select service pulldown menu and select Vault Radar.
Click the Select role pulldown menu and select the Vault Radar Developer role.
Click Save.
Click Back to Dashboard.
Click Vault Radar.
Click Resources.
Select the resource you want to assign to a group and click Assign groups.
Click the Assign resoruce to group pulldown menu.
Select the group that requires access to the resource.
Select either the Viewer or Contributor role.
Click OK.

Update data source host

Navigate to Settings.
Click Data Source Hosts
Click the vertical ellipsis to the right of the data source host.
To update the monitored data sources, click Edit data sources.
To update the token, click Edit data source host details.
To delete the data source host, click Delete data source host.

Tutorials

Learn how to evaluate and implement HCP Vault Radar in your environment with our tutorials.

HCP Vault Radar quickstart - Follow HashiCups, a fictitious coffee company, as they onboard HCP Vault Radar and scan their data sources for secrets.
HCP Vault Radar operation - Learn how HashiCups uses HCP Vault Radar advanced features to scan data sources with the Vault Radar agent, and correlates findings with HCP Vault to manage secrets.