Open Jberlinsky opened 3 years ago
Hi Jason,
We previously had referential constraints prior to integrating with Constraint Framework, however, there are some scaling issues for larger organizations. Referential constraints entail having the entire set of resources loaded into memory and Golang experiences roughly 60x increase in memory footprint for parsed JSON (eg, a 1GB CAI export will require 60GB of physical memory).
Enabling referential constraints would require implementing the rego function matching_reviews_and_constraints in pkg/gcptarget/library.go, creating the appropriate unit tests, plumbing through functionality for loading CAI information into Constraint Framework, and invoking the audit. Unfortunately, I have no plans to implement it at this time, however, I am willing to review pull requests.
-Brian
This is something we're still considering for the roadmap though.
+Marten van Wezel martenvw@google.com for awareness
On Fri, Jan 15, 2021 at 11:46 AM Morgante Pell notifications@github.com wrote:
This is something we're still considering for the roadmap though.
— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/forseti-security/config-validator/issues/160#issuecomment-761162085, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAZQCJQHC332EKQGTKQD63DS2CLR3ANCNFSM4WEQHKKQ .
Summary
I have a customer for whom referential constraints would drive outsize business value, enabling them to adopt Forseti Config Validator and Terraform Validator to implement detective and protective controls to safeguard their GCP organization.
Use Case
The specific use case identified is:
At present, we can pull sufficient information from CAI to determine that there is some ResourcePolicy attached to a Disk:
And subsequently pulling the
ResourcePolicy
CAI data yields information about the snapshot schedule:The ability to build policies that consider both of these CAI asset data objects at once would be valuable, and extensible to other security control implementations.