michaelmagyar
commented
1 year ago Adding some thoughts as Functionbeat is deprecated with support ending in less than a year, and federal clients and their service providers will need extensive time to plan, implement, re-document, and possibly get re-audited on the change (i.e., they may have to add SQS, Secrets Manager, etc. to their packages if they weren't using them before).
Elastic currently has a GovCloud account cluster that supports the FedRAMP offering. Because Elastic is already approved for GovCloud, the team that handles that account cluster should be able to either add ESF publishing directly to the existing GovCloud account(s) or create a new GovCloud account specifically for ESF publishing. The issue is compliance, and that needs to be thought of first in this case.
It may be possible to immediately add ESF to the existing GovCloud accounts. However, there might be some compliance issues with immediately adding additional functionality to that environment because that might change the ATO package and require a significant change request/re-audit.
If that is going to take some time (it could easily be 6-12 months), then an alternative is to:
- Now: Have a separate GovCloud account provisioned just for publishing ESF to the GovCloud SAR
- Later: Add ESF to the FedRAMP compliance package and migrate it to the existing federal AWS GovCloud accounts
- Even Later: Deprecate the initial GovCloud SAR registry publication and recommend customers switch to the new ARN
If that flow ends up happening and ESF is published to GovCloud outside of the existing federal offering, some entities still may not be able to leverage it for compliance reasons, but they would at least have the ability to make the risk-based decision and/or test that it works with time to implement it properly.
I think the steps are likely:
- [ ] Coordinate with the Elastic federal team to determine when ESF will become part of the federal offering (does it require a re-audit or can it be added immediately)
- [ ] If not immediately, consider requesting another GovCloud account that will remain outside of the FedRAMP package even if just for temporary ESF publishing to fix any compatibility issues with GovCloud
- [ ] Set up the existing pipeline to additionally publish to the chosen GovCloud account
- [ ] Tweak the ESF code that is not compatible with GovCloud (e.g., ARNs need to be "arn:${AWS::Partition}:" instead of "arn:aws:")
I hope this happens quickly and that it can be immediately added to the existing FedRAMP accounts/package, but I am not optimistic.
aspacca
bturquet
kaiyan-sheng
Currently, Elastic Serverless Forwarder(ESF) is not available in AWS GovCloud regions.
From the AWS docs "Applications that are publicly shared in other AWS Regions are not automatically available in AWS GovCloud (US) Regions. To make applications available in AWS GovCloud (US) Regions, you must publish and share them independently of other AWS Regions".
This issue is to publish ESF in AWS SAR to be made available on the AWS GovCloud(US) Regions.
There are certain requirements around who can have access to AWS GovCloud(US) Regions. For example: "AWS GovCloud (US-East) and (US-West) Regions are operated by employees who are U.S. citizens on U.S. soil. AWS GovCloud (US) is only accessible to U.S. entities and root account holders who pass a screening process. Customers must confirm that they will only use a U.S. person (green card holder or citizen as defined by the U.S. Department of State) to manage and access root account keys to these regions."