SPIKE: Groundwork to Test/Check the guardrails

[crochcunill]

Description To compile a list of the personas from the keycloak SSO roles. Then test systematically what each of these personas can can can not do.

I will need the input from Warren. Not sure if I will also require Avneet.

Additional Info There's some interesting documentation here https://github.com/canada-ca/cloud-guardrails-aws but we don't want to use Prowler or CloudCustodian, we want to test in CheckPoint CloudGuard CSPM

Deliverables

• 1st: list of the personas and its permissions (seek the tech team)
• 2nd: list of all possible permissions (maybe a bit too ambitious but cap to low effort with tech team)
• 3rd: test plan to verify the happy path: personas can do what they are allowed to base on 1st list
• 4th: test plan to verify the unhappy path: personas can not do what they are not allowed to base on 2nd list
• Get access to ECF AWS Dev CSPM from Julian and explore the rule sets, watch videos, try to understand how they could fit in a test plan.

[crochcunill]

Conclussions

• It is not practical to test every combination role/ressource/policy. There are simply too many to write and to maintain
• The AWS CLI command get-account-authorization-details returns a JSON file with all the IAM permissions associated to the account
• Some specific permissions may be tested individually, for example, change the access of a S3 bucket from public to private
• Test for specific permissions can be done through the AWS CLI or through the AWS web interface

Recommendations 1- Create a test that compare the results of the AWS CLI command get-account-authorization-details before/after SEA update/upgrade 2- Create a small suite of tests to verify persmissions that are deemed important enough to deserve their own test

Further work

• All of the above applies when using workload accounts, what means that we can not verify if the SCP have changed or not. Will need to decide if to also use an account with a higher role.
• If recommendation 2 is implemented, will need to select the permissions that will need to be tested
• Using AWS CLI seems to be the most straighforward way to test, however, there are some test where AWS GUI can provide more insight.

The full version of the finding for this spike have been gathered in the following spreadsheet

https://bcgov.sharepoint.com/:x:/t/01368-CPFScrumTeam/ETCQS97bu7VPmr8CaVyl6EAB1MA0dDo6dwo8eJHihbg4GQ?e=M6nzj5

For some background info about the relation between KC users and AWS roles check https://bcgov.sharepoint.com/:b:/t/01368-CPFScrumTeam/EUpY8z_4ZUVBssWFJtcBbOAB72B1Y57yQSbLR7HGQi8vZA?e=IokLfl