08/01/2024 - Delivery Working Group - All Hands Meeting Minutes

[damienjburks]

Date

08/01/2024 - 11:30am ET / 4:30pm UK

• Join Zoom Meeting
• Meeting ID: 930 1013 8669
• Passcode: 432980
• Copy this meeting to your calendar
• Find your local number

Meeting notices

• FINOS Project leads are responsible for observing the FINOS guidelines for running project meetings. Project maintainers can find additional resources in the FINOS Maintainers Cheatsheet.
• All participants in FINOS project meetings are subject to the LF Antitrust Policy, the FINOS Community Code of Conduct and all other FINOS policies.
• FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact legal@finos.org with any questions.
• FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

Agenda

• [x] Convene & roll call (5mins)
• [x] Display FINOS Antitrust Policy summary slide
• [x] Review Meeting Notices (see above)
• [x] Approve past meeting minutes
• [x] Project board walkthrough
• [x] https://github.com/finos/common-cloud-controls/discussions/268
• [x] https://github.com/finos/common-cloud-controls/issues/211
• [x] AOB, Q&A & Adjourn (5mins)

Untracked attendees

• Fullname, Affiliation, (optional) GitHub username
• ...

[psmulovics]

Peter Smulovics / Morgan Stanley

[damienjburks]

Damien Burks / Citi 👋🏾

[eddie-knight]

:wave: :shipit: Eddie Knight / Sonatype

[sshiells-scottlogic]

Stevie Shiells / Scott Logic

[robmoffat]

Rob Moffat / FINOS 🍒

[damienjburks]

Will publish meeting minutes by Monday morning 😸

[damienjburks]

Meeting Minutes

Date: August 1, 2024
Time: 3:30 PM
Location: Zoom Meeting

---

Attendee List:

• Stevie Shiells
• Damien Burks
• Eddie Knight
• Michael Lysaght
• Rob Moffat

Meeting Objective: Discuss the usage of different versions of the taxonomy and related controls, and to address questions regarding the release and validation of security artifacts and terraform modules.

Agenda Overview:

1. Discussion on the necessity and usage of different taxonomy versions.
2. Addressing questions on the deployment and validation of security artifacts.
3. Terraform modules and their validation process before release.

Detailed Discussion Points:

• Usage of Different Taxonomy Versions:

  • Stevie Shiells: Questioned the use of different versions of taxonomy without corresponding controls. Emphasized the need for controls to match the version of the taxonomy.
  • Damien: Added a question about the status and usage.
  • Eddie Knight: Explained the value in having a slow release of a cohesive cloud services taxonomy, which can be a reference for the community and used in design decisions and architecture conversations.

• Security Artifacts and Validation:

  • Eddie Knight: Described the process where security artifacts are released in small batches while the taxonomy is released in large batches. Highlighted the importance of having a highly granular and stable taxonomy.
  • Michael Lysaght: Asked about the offering related to terraform modules as part of the validation process.
  • Eddie Knight: Confirmed that terraform modules should pass validation before release to ensure they are secure by default.

• Terraform Modules Validation:

  • Eddie Knight: Emphasized the need for terraform modules to pass validation to confirm they are locked down and secure before deployment.
  • Damien: Acknowledged the importance of this validation process.

Additional Notes/Observations:

• The discussion highlighted the necessity for detailed and structured release processes to ensure the security and usability of taxonomy versions and terraform modules.
• There were concerns raised about the alignment between different versions and their respective controls to avoid potential gaps and ensure consistency.

Action Items:

1. Action: Ensure that controls are developed and released in tandem with each version of the taxonomy.
2. Action: Develop a validation process for terraform modules to ensure they are secure by default before release.

---

The transcript for this is highlighted below:

GMT20240801-153029_Recording.transcript.txt