search

common-fate / glide

Automate permissions to your cloud and critical applications.
https://docs.commonfate.io/common-fate/introduction
GNU Affero General Public License v3.0
237 stars 21 forks source link

Add mentions to Slack Notifier #641

Closed mickyco94 closed 10 months ago

mickyco94 commented 10 months ago

What changed?

image

Added the ability to specify a user/group and channel in rule description that will determine where slack notifications are sent. This is an optional path, will default to the existing behaviour of messaging all reviewers over DM.

For example, given a rule description such as:

This rule protects some resource.

@slack-C1234 <@sre-oncall>

this will result in a message being sent to channel with ID C1234 that tags the @sre-oncall group for review. They will be able to interact with the message to Approve and Reject in the same way they would a DM.

Note that Channel ID is used here as the Slack API does not support sending a message to a channel by name, or have a widely available API to look up Channel ID from a given name. An alternative is to use the chat.scheduleMessage API that does support channel name as well as channel id but this would mean adding a delay to messages of at least 10 seconds.

Why?

The existing slack notifications can be quite noisy if a large group of users can be approvers, this allows the option of reducing that noise by tagging a specific group for a specific rule and sending that notification to a channel that tags said group.

How did you test it?

Deploying Lambda locally against my own development environment and creating rules that satisfy the logic.

Potential risks

The changes are scoped to the Slack Notification Lambda, so any potential bugs should be isolated to slack notifications

Is patch release candidate?

Link to relevant docs PRs

shwethaumashanker commented 10 months ago

Hi @mickyco94, I was trying to test this by updating my release version to the one generated by the CI: https://granted-test-releases-us-west-2.s3.amazonaws.com/dev/1936bd90723bd2155ca6cc4e8b19dd2afc63b7e5/Granted.template.json. However, I didn't notice any updates in the common fate UI for creating or requesting access. Where would I have to add in the approver and channel ? Not sure if I'm missing something.

keymon commented 10 months ago

@shwethaumashanker not sure if I understood your question, but this change does not change the UI. Instead you must create a rule with a description including an anotation like @slack-C1234 <@sre-oncall>. When the request is sent it will send a message to the channel with ID C1234 mentioning @sre-oncall, instead of a DM to each of the approvers.

shwethaumashanker commented 10 months ago

Ah sorry, that makes sense, I misunderstood!