> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Org Default Permissions ### More Info: The default permission given to new organization users should be set to none. Read permissions risk exposing private repositories, while write or admin permissions risk sensitive access to repositories for new users. ### Risk Level Medium ### Address Security ### Compliance Standards * Cloudanix Best Practice ### Triage and Remediation ### Remediation Here’s how to lock down **Organization Default Permissions** in GitHub using the web console. ### 1. Open your Organization Settings 1. Sign in to GitHub. 2. In the top-right, click your profile picture. 3. Under “Organizations”, click the organization you want to configure. 4. In the org view, click **Settings** (top tabs). *** ### 2. Reduce Default Repository Permissions (Base Permissions) GitHub has a “base” (default) permission that applies to all org members on **all repositories** unless explicitly overridden. 1. In the left sidebar, look for one of: * **Member privileges**, or * **Organization security** → **Base permissions** (newer UI) 2. Find **Base permissions** or **Default repository permissions**. 3. Change from overly permissive settings (e.g., `Write` or `Admin`) to a least-privilege option: * Prefer **Read** or **None** depending on your policy: * **Read**: members can view all repos by default. * **None**: members only see repos they are explicitly granted access to. 4. Click **Save** / **Update**. *** ### 3. Restrict Who Can Create Repositories (if needed) 1. In the same **Member privileges** (or similar) section: 2. Under **Repository creation** / **Repository permissions**, adjust: * Allow creation of **Private**, **Internal**, **Public** repos only for: * **Organization owners** (strict), or * **Selected members** if you need delegated admins. 3. Save changes. *** ### 4. Review & Clean Up Existing Access Changing defaults does not fix past grants. Quickly review: 1. **People** tab → check member roles (Owner vs Member). 2. **Repositories** tab: * For sensitive repos, open the repo → **Settings** → **Collaborators and teams**: * Remove broad `Write`/`Admin` for `@org/*` or large teams. * Scope permissions narrowly (Read/Write/Admin per team/user). This sequence remediates overly permissive **Org Default Permissions** for GitHub IAM through the GitHub console. Below are step‑by‑step instructions to remediate overly‑permissive **Org Default Permissions** in GitHub using the GitHub CLI (`gh`), by tightening the default member privileges and default repository permissions. Assumptions: * You’re an org owner (or have equivalent admin rights). * You have `gh` installed and authenticated (`gh auth login`). *** ## 1. Identify Current Organization Default Settings Replace `ORG` with your organization login (e.g., `my-company`). ```bash theme={null} gh api \ -H "Accept: application/vnd.github+json" \ /orgs/ORG \ | jq '.default_repository_permission, .members_can_create_repositories, .members_allowed_repository_creation_type, .members_can_create_public_repositories, .members_can_create_private_repositories, .members_can_create_internal_repositories' ``` If you don’t have `jq`, remove the pipe and inspect JSON manually. *** ## 2. Restrict Default Repository Permission for Members To remediate “org default permissions” you typically want `read` or `none` (instead of `write` or `admin`) as the default permission for organization members on new repos. Available values: `read`, `write`, `admin`, `none`. Example: set default to `read`: ```bash theme={null} gh api \ -X PATCH \ -H "Accept: application/vnd.github+json" \ /orgs/ORG \ -f default_repository_permission=read ``` For the strictest posture (no automatic access): ```bash theme={null} gh api \ -X PATCH \ -H "Accept: application/vnd.github+json" \ /orgs/ORG \ -f default_repository_permission=none ``` *** ## 3. Restrict Members from Creating Repositories If your misconfiguration is that “any member can create repos”: ### 3.1 Disable Member Repo Creation Entirely ```bash theme={null} gh api \ -X PATCH \ -H "Accept: application/vnd.github+json" \ /orgs/ORG \ -f members_can_create_repositories=false ``` This forces repo creation to be done only by org owners or via approved automation. ### 3.2 (Optional) If You Allow Some Creation, Limit Types If you must allow creation, restrict types (GitHub Enterprise / orgs that support these flags): ```bash theme={null} gh api \ -X PATCH \ -H "Accept: application/vnd.github+json" \ /orgs/ORG \ -f members_can_create_repositories=true \ -f members_allowed_repository_creation_type=private \ -f members_can_create_public_repositories=false \ -f members_can_create_private_repositories=true \ -f members_can_create_internal_repositories=false ``` Adjust according to what is allowed in your org. *** ## 4. Confirm the New Configuration Re-run: ```bash theme={null} gh api \ -H "Accept: application/vnd.github+json" \ /orgs/ORG \ | jq '.default_repository_permission, .members_can_create_repositories, .members_allowed_repository_creation_type, .members_can_create_public_repositories, .members_can_create_private_repositories, .members_can_create_internal_repositories' ``` Verify: * `default_repository_permission` is `read` or `none` (per your policy). * `members_can_create_repositories` is `false` (or restricted as desired). * Allowed repo types match your security policy. *** ## 5. (Optional) Script It for Repeatable Use Example remediation script: ```bash theme={null} ORG="my-org" gh api -X PATCH -H "Accept: application/vnd.github+json" /orgs/$ORG \ -f default_repository_permission=none \ -f members_can_create_repositories=false ``` Run this for each organization you manage, adjusting `$ORG` and the values as needed. *** If you share your current JSON for `/orgs/ORG`, I can give you the exact `gh api` patch command tailored to your current misconfiguration. Below are concrete, step‑by‑step remediation instructions to lock down an organization’s default (base) permissions in GitHub using Python. Assumption:\ You want to enforce least-privilege by ensuring that **new org members and newly created repos don’t get broad access by default**. *** ## 1. Decide the Desired Default Permissions Typical least-privilege setup: * `default_repository_permission`: `"read"` or `"none"` * `members_can_create_repositories`: `false` * Optionally, also restrict: * `members_can_create_private_repositories` * `members_can_create_internal_repositories` * `members_can_create_public_repositories` * `members_can_create_pages` * `members_can_create_public_pages` * `members_can_create_private_pages` You can tune these, but for a strict setup: ```json theme={null} { "default_repository_permission": "read", "members_can_create_repositories": false, "members_can_create_private_repositories": false, "members_can_create_internal_repositories": false, "members_can_create_public_repositories": false } ``` *** ## 2. Prepare a Token with Correct Scopes 1. Create a **Fine-grained personal access token** or **classic PAT** with: * `admin:org` scope (for managing org settings) * If classic: also `read:org` if you want to read config first 2. Store it securely (e.g., environment variable `GITHUB_TOKEN`). *** ## 3. Identify Your Organization Name You need the login name of the org, e.g.: ```text theme={null} ORG_NAME = "my-org-name" ``` *** ## 4. Install Dependencies You can use `requests` (no extra install beyond `pip install requests`) or `PyGithub`. Below is with `requests` (simplest for IAM-like config changes): ```bash theme={null} pip install requests ``` *** ## 5. Python: Read Current Org Default Permissions ```python theme={null} import os import requests GITHUB_TOKEN = os.environ["GITHUB_TOKEN"] ORG_NAME = "my-org-name" session = requests.Session() session.headers.update({ "Authorization": f"Bearer {GITHUB_TOKEN}", "Accept": "application/vnd.github+json", "X-GitHub-Api-Version": "2022-11-28" }) org_url = f"https://api.github.com/orgs/{ORG_NAME}" resp = session.get(org_url) resp.raise_for_status() data = resp.json() print("Current defaults:") print("default_repository_permission:", data.get("default_repository_permission")) print("members_can_create_repositories:", data.get("members_can_create_repositories")) print("members_can_create_private_repositories:", data.get("members_can_create_private_repositories")) print("members_can_create_internal_repositories:", data.get("members_can_create_internal_repositories")) print("members_can_create_public_repositories:", data.get("members_can_create_public_repositories")) print("members_can_create_pages:", data.get("members_can_create_pages")) print("members_can_create_public_pages:", data.get("members_can_create_public_pages")) print("members_can_create_private_pages:", data.get("members_can_create_private_pages")) ``` Use this to verify what “org default permissions” currently are. *** ## 6. Python: Remediate (Set Least-Privilege Defaults) ```python theme={null} import os import requests GITHUB_TOKEN = os.environ["GITHUB_TOKEN"] ORG_NAME = "my-org-name" session = requests.Session() session.headers.update({ "Authorization": f"Bearer {GITHUB_TOKEN}", "Accept": "application/vnd.github+json", "X-GitHub-Api-Version": "2022-11-28" }) org_url = f"https://api.github.com/orgs/{ORG_NAME}" payload = { # Base/default permission for org members on organization repositories # Allowed: "read", "write", "admin", "none" "default_repository_permission": "read", # Strongly recommended: disable repo creation by members "members_can_create_repositories": False, # If your org supports these granular flags (GitHub Enterprise Cloud): "members_can_create_private_repositories": False, "members_can_create_internal_repositories": False, "members_can_create_public_repositories": False, # Optional, if you want to restrict GitHub Pages creation: # "members_can_create_pages": False, # "members_can_create_public_pages": False, # "members_can_create_private_pages": False, } resp = session.patch(org_url, json=payload) resp.raise_for_status() print("Updated org settings:") print(resp.json()) ``` *** ## 7. Verify Remediation Run the “read current settings” script again and confirm: * `default_repository_permission` matches your target (e.g. `"read"` or `"none"`). * Repository creation and other default capabilities are aligned with policy. *** ## 8. (Optional) Make This Enforceable / Repeatable * Put the script into CI/CD and: * Run it periodically or * Trigger on changes to a “org-policy” repo. * Fail the pipeline if the current settings do not match your policy JSON. *** If you tell me your exact desired policy (e.g., default permission level and which actions to allow for members), I can give you a ready-to-run Python script tailored to it. ```hcl theme={null} resource "github_organization_settings" "org" { # Replace with your GitHub organization name name = "GITHUB_ORG_NAME" # Set default permission for new organization members to none default_repository_permission = "none" # Other required / commonly used settings as applicable to your org billing_email = "BILLING_EMAIL@example.com" # Add/retain any other arguments you already manage here } ``` Changing `default_repository_permission` does not force resource replacement; it updates the organization setting in place. After you update your configuration, `terraform plan` should show a single `~` (update in-place) on `github_organization_settings.org` with `default_repository_permission` changing from its current value (e.g., `"read"`) to `"none"`. ### Additional Reading: * [https://help.github.com/en/articles/repository-permission-levels-for-an-organization](https://help.github.com/en/articles/repository-permission-levels-for-an-organization)