Buildkite

Set up Buildkite for automated tests with TrustCloud

TrustCloud’s API-based integrations map seamlessly to your frameworks and controls to power automated evidence collection, continuous monitoring, and predictive risk analysis. Let’s explore how you can set up Buildkite for automated tests.

By granting TrustCloud limited access to metadata through a service principal account, you can ensure that your systems remain compliant with your adopted controls. TrustCloud’s focus on trust, security, and simplifying compliance makes it a valuable asset in the GRC landscape.

Read our GRC Launchpad article: Integrations to learn more.

Explore 100+ evidence collection integrations to power evidence collection and real-time risk analysis.

Purpose

Once you set up your compliance program, TrustCloud works to ensure that your systems remain compliant with your adopted controls. To do so, TrustCloud retrieves lists of resources against systems in your product and business stack to use for compliance evidence.

This document outlines the steps to grant TrustCloud access to retrieve the following items from Buildkite to be used as evidence:

1. A list of continuous integration or deployment pipelines
2. A list of users with access to Buildkite

TrustCloud will retrieve this information via the Buildkite REST and GraphQL API’s and will need an API token created by an Admin user in order to authenticate and fetch this data.

Instructions to grant TrustCloud read-only access to your Buildkite organization

1. Log in to Buildkite as a user with administrative privileges in your Buildkite organization.
2. Click on the user name dropdown in the upper-right corner of the page, then click Personal Settings.
3. Navigate to the API Access Tokens section by clicking on the menu item in the sidebar on the left-hand side of the page, then click the New API Access Token button.
   
4. On the New API Access Token page, enter a description for the token, ex: “TrustCloud.”
5. Under Organization Access,  check the box corresponding to your organization
6. Under REST API Scopes, check the boxes corresponding to the following scopes:
   1. Read Builds: Permission to list and retrieve details of builds
   2. Read Organizations: permission to list and retrieve details of organizations
   3. Read Pipelines: Permission to list and retrieve details of pipelines
      
   4. Under the GraphQL API section, check the box to Enable GraphQL API Access. Click the “Create New API Access Token” button to finish creating the API access token. Copy the token and save it to enter it in the Integration configuration page in TrustCloud.
   5. Navigate to the Organization Settings page, then copy the value displayed in the Slug input field.
   6. Provide the API Access Token obtained in Step 7 and the organization Slug from Step 8 when setting up your credentials for the Buildkite integration in TrustCloud.

In conclusion, TrustCloud offers API-based integrations that seamlessly integrate with frameworks and controls to enable automated evidence collection, continuous monitoring, and predictive risk analysis. By setting up Buildkite for automated tests and granting TrustCloud limited access to metadata, organizations can ensure compliance with their adopted controls.

TrustCloud’s focus on trust, security, and simplifying compliance makes it a valuable asset in the GRC landscape. With over 100 evidence-collection integrations, TrustOps works to keep systems compliant and retrieve essential information from Buildkite, such as lists of continuous integration/deployment pipelines and users with access.