> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Org default permissions remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Here’s how to lock down **Organization Default Permissions** in GitHub using the web console.

        ### 1. Open your Organization Settings

        1. Sign in to GitHub.
        2. In the top-right, click your profile picture.
        3. Under “Organizations”, click the organization you want to configure.
        4. In the org view, click **Settings** (top tabs).

        ***

        ### 2. Reduce Default Repository Permissions (Base Permissions)

        GitHub has a “base” (default) permission that applies to all org members on **all repositories** unless explicitly overridden.

        1. In the left sidebar, look for one of:
           * **Member privileges**, or
           * **Organization security** → **Base permissions** (newer UI)
        2. Find **Base permissions** or **Default repository permissions**.
        3. Change from overly permissive settings (e.g., `Write` or `Admin`) to a least-privilege option:
           * Prefer **Read** or **None** depending on your policy:
             * **Read**: members can view all repos by default.
             * **None**: members only see repos they are explicitly granted access to.
        4. Click **Save** / **Update**.

        ***

        ### 3. Restrict Who Can Create Repositories (if needed)

        1. In the same **Member privileges** (or similar) section:
        2. Under **Repository creation** / **Repository permissions**, adjust:
           * Allow creation of **Private**, **Internal**, **Public** repos only for:
             * **Organization owners** (strict), or
             * **Selected members** if you need delegated admins.
        3. Save changes.

        ***

        ### 4. Review & Clean Up Existing Access

        Changing defaults does not fix past grants. Quickly review:

        1. **People** tab → check member roles (Owner vs Member).
        2. **Repositories** tab:
           * For sensitive repos, open the repo → **Settings** → **Collaborators and teams**:
             * Remove broad `Write`/`Admin` for `@org/*` or large teams.
             * Scope permissions narrowly (Read/Write/Admin per team/user).

        This sequence remediates overly permissive **Org Default Permissions** for GitHub IAM through the GitHub console.
      </Accordion>

      <Accordion title="Using CLI">
        Below are step‑by‑step instructions to remediate overly‑permissive **Org Default Permissions** in GitHub using the GitHub CLI (`gh`), by tightening the default member privileges and default repository permissions.

        Assumptions:

        * You’re an org owner (or have equivalent admin rights).
        * You have `gh` installed and authenticated (`gh auth login`).

        ***

        ## 1. Identify Current Organization Default Settings

        Replace `ORG` with your organization login (e.g., `my-company`).

        ```bash theme={null}
        gh api \
          -H "Accept: application/vnd.github+json" \
          /orgs/ORG \
          | jq '.default_repository_permission, .members_can_create_repositories, .members_allowed_repository_creation_type, .members_can_create_public_repositories, .members_can_create_private_repositories, .members_can_create_internal_repositories'
        ```

        If you don’t have `jq`, remove the pipe and inspect JSON manually.

        ***

        ## 2. Restrict Default Repository Permission for Members

        To remediate “org default permissions” you typically want `read` or `none` (instead of `write` or `admin`) as the default permission for organization members on new repos.

        Available values: `read`, `write`, `admin`, `none`.

        Example: set default to `read`:

        ```bash theme={null}
        gh api \
          -X PATCH \
          -H "Accept: application/vnd.github+json" \
          /orgs/ORG \
          -f default_repository_permission=read
        ```

        For the strictest posture (no automatic access):

        ```bash theme={null}
        gh api \
          -X PATCH \
          -H "Accept: application/vnd.github+json" \
          /orgs/ORG \
          -f default_repository_permission=none
        ```

        ***

        ## 3. Restrict Members from Creating Repositories

        If your misconfiguration is that “any member can create repos”:

        ### 3.1 Disable Member Repo Creation Entirely

        ```bash theme={null}
        gh api \
          -X PATCH \
          -H "Accept: application/vnd.github+json" \
          /orgs/ORG \
          -f members_can_create_repositories=false
        ```

        This forces repo creation to be done only by org owners or via approved automation.

        ### 3.2 (Optional) If You Allow Some Creation, Limit Types

        If you must allow creation, restrict types (GitHub Enterprise / orgs that support these flags):

        ```bash theme={null}
        gh api \
          -X PATCH \
          -H "Accept: application/vnd.github+json" \
          /orgs/ORG \
          -f members_can_create_repositories=true \
          -f members_allowed_repository_creation_type=private \
          -f members_can_create_public_repositories=false \
          -f members_can_create_private_repositories=true \
          -f members_can_create_internal_repositories=false
        ```

        Adjust according to what is allowed in your org.

        ***

        ## 4. Confirm the New Configuration

        Re-run:

        ```bash theme={null}
        gh api \
          -H "Accept: application/vnd.github+json" \
          /orgs/ORG \
          | jq '.default_repository_permission, .members_can_create_repositories, .members_allowed_repository_creation_type, .members_can_create_public_repositories, .members_can_create_private_repositories, .members_can_create_internal_repositories'
        ```

        Verify:

        * `default_repository_permission` is `read` or `none` (per your policy).
        * `members_can_create_repositories` is `false` (or restricted as desired).
        * Allowed repo types match your security policy.

        ***

        ## 5. (Optional) Script It for Repeatable Use

        Example remediation script:

        ```bash theme={null}
        ORG="my-org"

        gh api -X PATCH -H "Accept: application/vnd.github+json" /orgs/$ORG \
          -f default_repository_permission=none \
          -f members_can_create_repositories=false
        ```

        Run this for each organization you manage, adjusting `$ORG` and the values as needed.

        ***

        If you share your current JSON for `/orgs/ORG`, I can give you the exact `gh api` patch command tailored to your current misconfiguration.
      </Accordion>

      <Accordion title="Using Python">
        Below are concrete, step‑by‑step remediation instructions to lock down an organization’s default (base) permissions in GitHub using Python.

        Assumption:\
        You want to enforce least-privilege by ensuring that **new org members and newly created repos don’t get broad access by default**.

        ***

        ## 1. Decide the Desired Default Permissions

        Typical least-privilege setup:

        * `default_repository_permission`: `"read"` or `"none"`
        * `members_can_create_repositories`: `false`
        * Optionally, also restrict:
          * `members_can_create_private_repositories`
          * `members_can_create_internal_repositories`
          * `members_can_create_public_repositories`
          * `members_can_create_pages`
          * `members_can_create_public_pages`
          * `members_can_create_private_pages`

        You can tune these, but for a strict setup:

        ```json theme={null}
        {
          "default_repository_permission": "read",
          "members_can_create_repositories": false,
          "members_can_create_private_repositories": false,
          "members_can_create_internal_repositories": false,
          "members_can_create_public_repositories": false
        }
        ```

        ***

        ## 2. Prepare a Token with Correct Scopes

        1. Create a **Fine-grained personal access token** or **classic PAT** with:
           * `admin:org` scope (for managing org settings)
           * If classic: also `read:org` if you want to read config first

        2. Store it securely (e.g., environment variable `GITHUB_TOKEN`).

        ***

        ## 3. Identify Your Organization Name

        You need the login name of the org, e.g.:

        ```text theme={null}
        ORG_NAME = "my-org-name"
        ```

        ***

        ## 4. Install Dependencies

        You can use `requests` (no extra install beyond `pip install requests`) or `PyGithub`. Below is with `requests` (simplest for IAM-like config changes):

        ```bash theme={null}
        pip install requests
        ```

        ***

        ## 5. Python: Read Current Org Default Permissions

        ```python theme={null}
        import os
        import requests

        GITHUB_TOKEN = os.environ["GITHUB_TOKEN"]
        ORG_NAME = "my-org-name"

        session = requests.Session()
        session.headers.update({
            "Authorization": f"Bearer {GITHUB_TOKEN}",
            "Accept": "application/vnd.github+json",
            "X-GitHub-Api-Version": "2022-11-28"
        })

        org_url = f"https://api.github.com/orgs/{ORG_NAME}"

        resp = session.get(org_url)
        resp.raise_for_status()
        data = resp.json()

        print("Current defaults:")
        print("default_repository_permission:", data.get("default_repository_permission"))
        print("members_can_create_repositories:", data.get("members_can_create_repositories"))
        print("members_can_create_private_repositories:", data.get("members_can_create_private_repositories"))
        print("members_can_create_internal_repositories:", data.get("members_can_create_internal_repositories"))
        print("members_can_create_public_repositories:", data.get("members_can_create_public_repositories"))
        print("members_can_create_pages:", data.get("members_can_create_pages"))
        print("members_can_create_public_pages:", data.get("members_can_create_public_pages"))
        print("members_can_create_private_pages:", data.get("members_can_create_private_pages"))
        ```

        Use this to verify what “org default permissions” currently are.

        ***

        ## 6. Python: Remediate (Set Least-Privilege Defaults)

        ```python theme={null}
        import os
        import requests

        GITHUB_TOKEN = os.environ["GITHUB_TOKEN"]
        ORG_NAME = "my-org-name"

        session = requests.Session()
        session.headers.update({
            "Authorization": f"Bearer {GITHUB_TOKEN}",
            "Accept": "application/vnd.github+json",
            "X-GitHub-Api-Version": "2022-11-28"
        })

        org_url = f"https://api.github.com/orgs/{ORG_NAME}"

        payload = {
            # Base/default permission for org members on organization repositories
            # Allowed: "read", "write", "admin", "none"
            "default_repository_permission": "read",

            # Strongly recommended: disable repo creation by members
            "members_can_create_repositories": False,

            # If your org supports these granular flags (GitHub Enterprise Cloud):
            "members_can_create_private_repositories": False,
            "members_can_create_internal_repositories": False,
            "members_can_create_public_repositories": False,

            # Optional, if you want to restrict GitHub Pages creation:
            # "members_can_create_pages": False,
            # "members_can_create_public_pages": False,
            # "members_can_create_private_pages": False,
        }

        resp = session.patch(org_url, json=payload)
        resp.raise_for_status()

        print("Updated org settings:")
        print(resp.json())
        ```

        ***

        ## 7. Verify Remediation

        Run the “read current settings” script again and confirm:

        * `default_repository_permission` matches your target (e.g. `"read"` or `"none"`).
        * Repository creation and other default capabilities are aligned with policy.

        ***

        ## 8. (Optional) Make This Enforceable / Repeatable

        * Put the script into CI/CD and:
          * Run it periodically or
          * Trigger on changes to a “org-policy” repo.
        * Fail the pipeline if the current settings do not match your policy JSON.

        ***

        If you tell me your exact desired policy (e.g., default permission level and which actions to allow for members), I can give you a ready-to-run Python script tailored to it.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "github_organization_settings" "org" {
          # Replace with your GitHub organization name
          name = "GITHUB_ORG_NAME"

          # Set default permission for new organization members to none
          default_repository_permission = "none"

          # Other required / commonly used settings as applicable to your org
          billing_email = "BILLING_EMAIL@example.com"

          # Add/retain any other arguments you already manage here
        }
        ```

        Changing `default_repository_permission` does not force resource replacement; it updates the organization setting in place.

        After you update your configuration, `terraform plan` should show a single `~` (update in-place) on `github_organization_settings.org` with `default_repository_permission` changing from its current value (e.g., `"read"`) to `"none"`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>