Ensure the pipeline image uses a non latest version tag

Description

This policy checks whether the pipeline image uses a non-'latest' version tag. Using the 'latest' tag can lead to unpredictable behavior and potential security vulnerabilities, as the image version may change without notice. It's essential to specify a fixed version tag to ensure consistency and reliability in the pipeline. By doing so, you can avoid potential issues and ensure that your pipeline always uses the intended image version.

Code Example

jobs:
  build-and-test:
    docker:
      - image: circleci/python:3.9.5

Remediation

Specify a fixed version tag for the pipeline image instead of using 'latest'.

Rule Details

Field	Value
ID	IAC-0822
Severity	MEDIUM
IaC Type	circleci_pipelines
Frameworks	jobs.*.docker[].
Checkov ID	CKV_CIRCLECIPIPELINES_1

References

• Checkov Rule

---