Cloud Custodian Joint Review markdown #786

sunstonesecure-robert · 2021-09-08T17:35:24Z

needs review and final content

* Headers capitalized * Some grammar updates Various opinionated changes for readability and consistency.

attack paths

attack paths with source

adding some attack paths and diagram

Consistency and refinement for initial land

lumjjb

Initial housekeeping comments

assessments/projects/custodian/joint-review.md

lumjjb · 2021-09-08T17:40:31Z

assessments/projects/custodian/joint-review.md

+| Security Provider               | Yes, however many users implement Cloud Custodian for non security purposes, i.e., cost optimization, governance |
+| Languages                       | Python, YAML |
+| Incubation PR                   | https://github.com/cncf/toc/pull/480 |
+| SIG-Security Assessment Request | https://github.com/cncf/sig-security/issues/307 |


Suggested change

| SIG-Security Assessment Request | https://github.com/cncf/sig-security/issues/307 |

| TAG-Security Assessment Request | https://github.com/cncf/tag-security/issues/307 |

adding overview matrix

fix colors

add missing matrix

Markdown linter. Consolidating unordered list styles (i.e. `*` versus `-` to silence linter; trailing period style, etc.). Swapping out instances of "Custodian" and "c7n" with "Cloud Custodian" (where appropriate). Updating TOC via CLI TOC-generator tool.

Adding reviewers/participant section.

[CNCF-STAG-786] WIP Cloud Custodian Joint Review markdown

assessments/projects/custodian/joint-review.md

ashutosh-narkar · 2021-09-09T16:33:57Z

assessments/projects/custodian/joint-review.md

+
+### Case Studies
+
+TODO: 2-3 scenarios of real-world use cases.


This will be resolved before we merge this correct ?

will ping Jorge and @kapilt

@sunstonesecure-robert @castrojo This is still outstanding. Please add 2-3 real world use cases before we can merge in, otherwise everything is good to go.

sunstonesecure-robert · 2022-01-10T22:04:54Z

I'm not sure how to get past the spelling check issue - these are expected words we want in the content?

I have fixed the markdown formatting issues.

TheFoxAtWork · 2022-01-10T22:06:25Z

@sunstonesecure-robert i've got an outstanding PR to correct some of the larger spelling items (add to the linter). i'm waiting on one of the leadership team to review/approve

…g-security into pr/sunstonesecure-robert/786

TheFoxAtWork

Case Studies/Use cases are still outstanding. Please add them and then we can merge it in 🥳

TheFoxAtWork · 2022-01-11T15:20:31Z

assessments/projects/custodian/joint-review.md

+
+### Case Studies
+
+TODO: 2-3 scenarios of real-world use cases.


@sunstonesecure-robert @castrojo This is still outstanding. Please add 2-3 real world use cases before we can merge in, otherwise everything is good to go.

castrojo · 2022-01-11T19:46:09Z

I've added the case studies for you to copy and paste @sunstonesecure-robert

https://gist.github.com/castrojo/9c6058bc170cef075075b8f1f90b7515

verbatim from https://gist.githubusercontent.com/castrojo/9c6058bc170cef075075b8f1f90b7515/raw/9a261a45589770fe266396192a7b46d407ffd9f8/gistfile1.txt but with formatting changes for linter happiness

sunstonesecure-robert · 2022-01-12T15:56:35Z

added @castrojo content with formatting fixups

TheFoxAtWork · 2022-01-12T16:34:15Z

@ashutosh-narkar please review

ashutosh-narkar

Overall lgtm. Some minor comments.

ashutosh-narkar · 2022-01-12T20:29:29Z

assessments/projects/custodian/joint-review.md

+security flaws.  As a utility tool, the review team feels the primary threat to
+the project is compromise of the code itself, and packaging and distribution of
+the tool or its dependencies - rather than an attack on individual c7n


I'm curious what led to this conclusion since we haven't done a code review or tried out a sample deployment.

ashutosh-narkar · 2022-01-12T20:42:08Z

assessments/projects/custodian/joint-review.md

+## Hands-on Review
+
+Although some of the reviews have previously used c7n in AWS, both as cli and
+in Lambda, Cloud Custodian did not receive a join hands-on review from


Nit: joint

ashutosh-narkar · 2022-01-12T20:44:29Z

assessments/projects/custodian/joint-review.md

+|                      |                  |          |                          |               |                                |
+|                      |                  |          |                          |               |                                |
+----------------------+------------------+----------+--------------------------+---------------+--------------------------------+
+```


Do we need the HIGH vulnerabilities to be resolved or at least require the c7n team to open issues for them and link them here ?

These are operating system library level considerations not per se the project's responsibility to fix, but the distribution vendor, ie a libc high issue is something i would expect the os vendor to triage and fix as needed. This is also specific to a distribution channel, and immaterial for those that install the project's software directly into their own OS / container base. For direct application dependency graphs concerns we already address those pro actively (dependabot alerts etc).

these were from the Github action docker scan - if the project is releasing/maintaining a docker image I think the user expectation is they should be fixing high security risks in the image as good hygiene.

maybe best to just do source releases? or clearly document that the image is not secure?

This feels like a misunderstanding of operating system docker images, and what severity levels correspond to a need to immediate triage. If we take any production docker image out there using an operating system, they all have these sorts of cve nits wrt to high severity scoring. Take anything from redis to postgresql, (trivy image redis:latest etc), that doesn't make them insecure or high risk (trivy output for both here https://gist.github.com/cbdd697ce7f8ad0a40896c0a081c1a7c). The most relevant cves are those deemed critical, but all of operating system cves are triaged and dealt with by the security team of the respective distros which in many cases are professional security teams focused on exactly this topic. Moreover unlike postgresql or redis, we're talking about software in custodian that doesn't have an open port, its literally a cli, not a daemon or service running in a container.

My original comment was related to direct dependancies of c7n. @kapilt I think you mentioned you have a process to handle those iiuc.

for custodian's dependency graph, we rely on dependabot alerts https://docs.github.com/en/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies against our poetry.lock files which contain the version/hash dependency pins for the project. that alert is a prompt for us to update our dependency graph. our dep graph update process is automated and documented https://cloudcustodian.io/docs/developer/packaging.html and done regularly independent of vulnerabilities as a prelude to our release process.

also to be specific there are zero cves extant on our application dependency graph at the moment.

Thanks for the clarification.

assessments/projects/custodian/joint-review.md

TheFoxAtWork

@ashutosh-narkar are we good to merge this in?

ashutosh-narkar

LGTM

ashutosh-narkar · 2022-01-24T18:21:23Z

@sunstonesecure-robert can you please rebase and we can merge this. Thanks.

sunstonesecure-robert · 2022-01-26T17:28:31Z

@sunstonesecure-robert can you please rebase and we can merge this. Thanks.

try now

ashutosh-narkar · 2022-01-26T18:00:16Z

@sunstonesecure-robert can you please rebase and we can merge this. Thanks.

try now

Thanks. Can you please also squash your commits.

chasemp · 2022-02-01T18:41:51Z

It happened!

* Create joint-review.md * Update joint-review.md * Update joint-review.md * Update joint-review.md * Update joint-review.md * Consistency and refinement for initial land * Headers capitalized * Some grammar updates Various opinionated changes for readability and consistency. * Add files via upload attack paths * Delete CloudCustodian DFD.drawio.png * Add files via upload attack paths with source * Update joint-review.md adding some attack paths and diagram * Add files via upload adding overview matrix * Add files via upload fix colors * Update joint-review.md add missing matrix * Squashing paragraphs to 80-column line-length to appeasease `mdl` Markdown linter. Consolidating unordered list styles (i.e. `*` versus `-` to silence linter; trailing period style, etc.). Swapping out instances of "Custodian" and "c7n" with "Cloud Custodian" (where appropriate). Updating TOC via CLI TOC-generator tool. * Updating TOC. Adding reviewers/participant section. * Update joint-review.md adding additional CNCF recommendation for linter and/or locked down policy * Update assessments/projects/custodian/joint-review.md Co-authored-by: Emily Fox <[email protected]> * Update assessments/projects/custodian/joint-review.md Co-authored-by: Emily Fox <[email protected]> * Update assessments/projects/custodian/joint-review.md Co-authored-by: Emily Fox <[email protected]> * Update assessments/projects/custodian/joint-review.md Co-authored-by: Emily Fox <[email protected]> * add reviewer table per template both those who contributed on the first round and the most recent cycles * typo correction fix grammar * fix typo misspelling * Update assessments/projects/custodian/joint-review.md Co-authored-by: Emily Fox <[email protected]> * Update assessments/projects/custodian/joint-review.md Co-authored-by: Emily Fox <[email protected]> * Update assessments/projects/custodian/joint-review.md Co-authored-by: Emily Fox <[email protected]> * Update assessments/projects/custodian/joint-review.md Co-authored-by: Emily Fox <[email protected]> * update reviewers table last but NOT least * Update assessments/projects/custodian/joint-review.md Co-authored-by: Emily Fox <[email protected]> * Update assessments/projects/custodian/joint-review.md Co-authored-by: Emily Fox <[email protected]> * capitalize consistently * Update assessments/projects/custodian/joint-review.md Co-authored-by: Emily Fox <[email protected]> * Update assessments/projects/custodian/joint-review.md Co-authored-by: Emily Fox <[email protected]> * use consistent YAML the official docs use uppercase * What: non spelling linter corrections * Update joint-review.md fixing linter issues for markdown * What: ignore cSpell for GH handles * What: general spelling corrections * fixing my mistake * Update assessments/projects/custodian/joint-review.md * added case studies verbatim from https://gist.githubusercontent.com/castrojo/9c6058bc170cef075075b8f1f90b7515/raw/9a261a45589770fe266396192a7b46d407ffd9f8/gistfile1.txt but with formatting changes for linter happiness * What: add ignore for JPMC * What: fix lint * Update assessments/projects/custodian/joint-review.md Co-authored-by: Chase Pettet <[email protected]> Co-authored-by: Matthew Giassa <[email protected]> Co-authored-by: Emily Fox <[email protected]> Co-authored-by: Emily Fox <[email protected]>

sunstonesecure-robert and others added 12 commits August 31, 2021 07:55

Create joint-review.md

f95dfe6

Update joint-review.md

c6d9034

Update joint-review.md

038358f

Update joint-review.md

907293d

Update joint-review.md

257f41b

Consistency and refinement for initial land

912acf7

* Headers capitalized * Some grammar updates Various opinionated changes for readability and consistency.

Add files via upload

851239b

attack paths

Delete CloudCustodian DFD.drawio.png

7b95ba5

Add files via upload

7f2685e

attack paths with source

Update joint-review.md

c3a4fce

adding some attack paths and diagram

Merge pull request #1 from chasemp/patch-2

911974b

Consistency and refinement for initial land

Merge branch 'cncf:main' into patch-1

bb260ee

sunstonesecure-robert requested review from achetal01, anvega, ashutosh-narkar, dshaw, JustinCappos, lumjjb, pragashj, TheFoxAtWork and ultrasaurus as code owners September 8, 2021 17:35

lumjjb reviewed Sep 8, 2021

View reviewed changes

TheFoxAtWork changed the title ~~Cloud Custodian Joint Review markdown~~ WIP Cloud Custodian Joint Review markdown Sep 8, 2021

sunstonesecure-robert and others added 6 commits September 8, 2021 13:37

Add files via upload

e6ffcf4

adding overview matrix

Add files via upload

445ed70

fix colors

Update joint-review.md

8019565

add missing matrix

Updating TOC.

05d978f

Adding reviewers/participant section.

Merge pull request #2 from IAXES/patch-1

e86d6b9

[CNCF-STAG-786] WIP Cloud Custodian Joint Review markdown

ashutosh-narkar reviewed Sep 9, 2021

View reviewed changes

TheFoxAtWork and others added 6 commits January 10, 2022 17:09

What: ignore cSpell for GH handles

7b6f278

Merge branch 'main' into patch-1

17b33cb

What: general spelling corrections

4959f33

Merge branch 'patch-1' of https://github.com/sunstonesecure-robert/ta…

1136529

…g-security into pr/sunstonesecure-robert/786

fixing my mistake

8c6ad06

Update assessments/projects/custodian/joint-review.md

be5cd62

TheFoxAtWork requested changes Jan 11, 2022

View reviewed changes

added case studies

efb2019

verbatim from https://gist.githubusercontent.com/castrojo/9c6058bc170cef075075b8f1f90b7515/raw/9a261a45589770fe266396192a7b46d407ffd9f8/gistfile1.txt but with formatting changes for linter happiness

TheFoxAtWork added 2 commits January 12, 2022 11:27

What: add ignore for JPMC

5290a1d

What: fix lint

425aa4c

ashutosh-narkar reviewed Jan 12, 2022

View reviewed changes

Merge branch 'main' into patch-1

7b80fe1

TheFoxAtWork reviewed Jan 24, 2022

View reviewed changes

assessments/projects/custodian/joint-review.md Outdated Show resolved Hide resolved

Update assessments/projects/custodian/joint-review.md

4910d51

TheFoxAtWork approved these changes Jan 24, 2022

View reviewed changes

ashutosh-narkar approved these changes Jan 24, 2022

View reviewed changes

Merge branch 'cncf:main' into patch-1

a12e8b4

sunstonesecure-robert requested a review from PushkarJ as a code owner January 26, 2022 17:27

Merge branch 'main' into patch-1

5761cc2

TheFoxAtWork merged commit 803e3ff into cncf:main Feb 1, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Cloud Custodian Joint Review markdown #786

Cloud Custodian Joint Review markdown #786

sunstonesecure-robert commented Sep 8, 2021

lumjjb left a comment

lumjjb Sep 8, 2021 •

edited

Loading

ashutosh-narkar Sep 9, 2021

sunstonesecure-robert Sep 15, 2021

TheFoxAtWork Jan 11, 2022

sunstonesecure-robert commented Jan 10, 2022

TheFoxAtWork commented Jan 10, 2022

TheFoxAtWork left a comment

TheFoxAtWork Jan 11, 2022

castrojo commented Jan 11, 2022

sunstonesecure-robert commented Jan 12, 2022

TheFoxAtWork commented Jan 12, 2022

ashutosh-narkar left a comment

ashutosh-narkar Jan 12, 2022

ashutosh-narkar Jan 12, 2022

ashutosh-narkar Jan 12, 2022

kapilt Jan 18, 2022

marinesunstone Jan 18, 2022

kapilt Jan 18, 2022

ashutosh-narkar Jan 19, 2022

kapilt Jan 19, 2022

kapilt Jan 19, 2022

ashutosh-narkar Jan 19, 2022

TheFoxAtWork left a comment

ashutosh-narkar left a comment

ashutosh-narkar commented Jan 24, 2022

sunstonesecure-robert commented Jan 26, 2022

ashutosh-narkar commented Jan 26, 2022

chasemp commented Feb 1, 2022

	\| SIG-Security Assessment Request \| https://github.com/cncf/sig-security/issues/307 \|
	\| TAG-Security Assessment Request \| https://github.com/cncf/tag-security/issues/307 \|


		### Case Studies

		TODO: 2-3 scenarios of real-world use cases.

Cloud Custodian Joint Review markdown #786

Cloud Custodian Joint Review markdown #786

Conversation

sunstonesecure-robert commented Sep 8, 2021

lumjjb left a comment

Choose a reason for hiding this comment

lumjjb Sep 8, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sunstonesecure-robert commented Jan 10, 2022

TheFoxAtWork commented Jan 10, 2022

TheFoxAtWork left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

castrojo commented Jan 11, 2022

sunstonesecure-robert commented Jan 12, 2022

TheFoxAtWork commented Jan 12, 2022

ashutosh-narkar left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

TheFoxAtWork left a comment

Choose a reason for hiding this comment

ashutosh-narkar left a comment

Choose a reason for hiding this comment

ashutosh-narkar commented Jan 24, 2022

sunstonesecure-robert commented Jan 26, 2022

ashutosh-narkar commented Jan 26, 2022

chasemp commented Feb 1, 2022

lumjjb Sep 8, 2021 •

edited

Loading