search

salesforce / aws-allowlister

Automatically compile an AWS Service Control Policy that ONLY allows AWS services that are compliant with your preferred compliance frameworks.
MIT License
220 stars 34 forks source link

PCI Allowlist findings #1

Closed jdyke closed 3 years ago

jdyke commented 3 years ago

I did some QA against the PCI policy generated via aws-allowlister generate --pci and have recorded my thoughts below. I'll still need to test these to verify if A) they're required for the service to function properly (if its related to a different approved service) and B) how much wiggle room there is to throw those in if they are not approved.

The following are included in the aws-allowlister JSON but are not in the list of PCI services (I did not include permissions like account and sts which are generally required to use AWS.

The following are approved services / programs and are not included in the JSON output file but should be.

Let me know what you think about these.

Thanks!

kmcquade commented 3 years ago

@jdyke - for AppMesh, that is because AppMesh is only for PCI.

image

I realize the CLI arguments were not consistent. Now, it will give you the intersection of SOC, PCI, ISO, and HIPAA. You can specify them individually. And the logging indicates the active options to the user. You can quiet the logs with --quiet as well.

image

Status per service

Here is my worksheet based on the list you gave. These are services that are given when you supply aws-allowlister --pci, given my newest changes. I will update as we go along.

kmcquade commented 3 years ago

The following are included in the aws-allowlister JSON but are not in the list of PCI services (I did not include permissions like account and sts which are generally required to use AWS. (chime, ses, sso and sso-directory)

kmcquade commented 3 years ago

Regarding sso and sso-directory: that's because I added the following to the global_inserts section of the overrides.yml file:

https://github.com/salesforce/aws-allowlister/blob/main/aws_allowlister/data/overrides.yml#L152-L153

I am hesitant to remove that because I think it would break a lot of orgs, and I suspect that might be an error? No idea how AWS SSO is not approved lol

jdyke commented 3 years ago

for AppMesh, that is because AppMesh is only for PCI.

Ah so I was misreading how it worked. I like the way it works now - if someone passes in a pci argument, only PCI compliant services should return. That provides a lot of flexibility and allows more granular JSON policies vs one policy with many compliance / accreditation combined.

Regarding sso and sso-directory: that's because I added the following to the global_inserts section of the overrides.yml file

I totally missed that functionality, if its not in the readme somewhere ill add it.

I followed up about the sso situation. I think it will be ok to leave it out of the SCP for PCI because that SCP should only be applied to cat 1 accounts and your SSO "hub" should be cat 2. Thats my hypothesis and ill report back with my findings.

@kmcquade would you like me to QA the HIPAA JSON now that they're separated?

kmcquade commented 3 years ago

@jdyke - I fixed all the services mentioned above for PCI, except for Chatbot. I think that might be due to the fact that the SDK name is missing from the web page.

kmcquade commented 3 years ago

I am closing this because I fixed everything except for Chatbot. Addressing chatbot in a separate issue.

I will open up issues for other compliance frameworks