Skip to content

Commit 14abe3e

Browse files
iMichaelaiMichaela
authored
Merge pull request #82 from usnistgov/ac2-automation
AC-02 control automation - part 1 (actions) completed
2 parents 33726d6 + d9416cb commit 14abe3e

21 files changed

+1050
-448
lines changed

‎.github/ISSUE_TEMPLATE/account_management_authorization_form.yaml

-81
This file was deleted.

‎.github/ISSUE_TEMPLATE/account_management_request_form.yaml

+16-2
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,33 @@ description: Submit an account related request
33
labels: ['ACCOUNT_REQUEST_RECORD']
44
body:
55
- type: input
6-
id: first-name
6+
id: user-first-name
77
attributes:
88
label: Account Holder First Name
99
placeholder: Type here user's first name as it appears in his/her ID.
1010
validations:
1111
required: true
1212
- type: input
13-
id: last-name
13+
id: user-last-name
1414
attributes:
1515
label: Account Holder Last Name
1616
placeholder: Type here user's last name as it appears in his/her ID.
1717
validations:
1818
required: true
19+
- type: input
20+
id: user-email
21+
attributes:
22+
label: Account Holder Email
23+
placeholder: Type here user's email
24+
validations:
25+
required: true
26+
- type: input
27+
id: user-username
28+
attributes:
29+
label: Account Holder Username
30+
placeholder: Type here user's username
31+
validations:
32+
required: true
1933
- type: input
2034
id: requester-name
2135
attributes:

‎.github/workflows/account_request_approve.yaml

+79-1
Original file line numberDiff line numberDiff line change
@@ -21,4 +21,82 @@ jobs:
2121
NUMBER: ${{ github.event.issue.number }}
2222
BODY: >
2323
Account management request APPROVED by Blossom Management.
24-
@blossom-sysdevs please review and submit Account Management Authorization Form.
24+
@usnistgov/blossom-sysdevs please ensure the ACL and/or Cognito are updated and the SSP is in sync with the update.
25+
When implemented, add the ACCOUNT_IMPLEMENTED label and
26+
link this account request issue to the PR with the implementation.
27+
28+
parse-issue:
29+
needs: request-approved
30+
runs-on: ubuntu-20.04
31+
outputs:
32+
account-modification: ${{ steps.issue-parser.outputs.issueparser_account-modification }}
33+
user-first-name: ${{ steps.issue-parser.outputs.issueparser_user-first-name }}
34+
user-last-name: ${{ steps.issue-parser.outputs.issueparser_user-last-name }}
35+
user-username: ${{ steps.issue-parser.outputs.issueparser_user-username }}
36+
user-email: ${{ steps.issue-parser.outputs.issueparser_user-email }}
37+
account-type: ${{ steps.issue-parser.outputs.issueparser_account-type }}
38+
steps:
39+
- name: Checkout repo
40+
uses: actions/checkout@v4
41+
with:
42+
sparse-checkout: |
43+
.github/ISSUE_TEMPLATE/account_management_request_form.yaml
44+
sparse-checkout-cone-mode: false
45+
46+
- name: Parse issue body
47+
uses: stefanbuck/[email protected]
48+
id: issue-parser
49+
with:
50+
template-path: ".github/ISSUE_TEMPLATE/account_management_request_form.yaml"
51+
52+
create-user:
53+
needs: parse-issue
54+
if: ${{ needs.parse-issue.outputs.account-modification == 'Create' }}
55+
runs-on: ubuntu-20.04
56+
steps:
57+
- name: Checkout repo
58+
uses: actions/checkout@v4
59+
60+
- name: Ensure directory exists for created users
61+
run: |
62+
mkdir -p ato/oscal-artifacts/created_users/
63+
64+
- name: Ensure directory exists for created users references
65+
run: |
66+
mkdir -p ato/oscal-artifacts/reference_created_users/
67+
68+
- name: Create yaml file for automated user creation
69+
env:
70+
USER_NAME: "${{ needs.parse-issue.outputs.user-first-name }} ${{ needs.parse-issue.outputs.user-last-name }}"
71+
USER_USERNAME: ${{ needs.parse-issue.outputs.user-username }}
72+
USER_EMAIL: ${{ needs.parse-issue.outputs.user-email }}
73+
USER_ROLE: ${{ needs.parse-issue.outputs.account-type }}
74+
ISSUE_NUMBER: ${{ github.event.issue.number }}
75+
run: |
76+
python ato/secops/create_user.py --user-name "$USER_NAME" --user-username "$USER_USERNAME" --user-email "$USER_EMAIL" --user-role "$USER_ROLE" --issue-number "$ISSUE_NUMBER"
77+
78+
- name: Store user yaml in repo
79+
run: |
80+
git config --global user.name "create-user-action[bot]"
81+
git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
82+
git checkout -b "$BRANCH_NAME"
83+
git add "ato/oscal-artifacts/created_users/*"
84+
git add "ato/oscal-artifacts/reference_created_users/*"
85+
git commit -m "Create user request #$ISSUE_NUMBER"
86+
git push origin "$BRANCH_NAME"
87+
env:
88+
ISSUE_NUMBER: ${{ github.event.issue.number }}
89+
BRANCH_NAME: "account-request-${{ github.event.issue.number }}"
90+
91+
- name: Configure AWS CLI
92+
uses: aws-actions/configure-aws-credentials@v4
93+
with:
94+
aws-region: ${{ secrets.AWS_REGION }}
95+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
96+
aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY }}
97+
98+
- name: Copy reference yaml to bucket
99+
run: |
100+
aws s3 cp --recursive ato/oscal-artifacts/reference_created_users/ s3://"$AWS_BUCKET"
101+
env:
102+
AWS_BUCKET: ${{ secrets.AWS_BUCKET }}

‎.github/workflows/account_request_assessment.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
name: Account Request Assessment
2+
3+
on:
4+
pull_request:
5+
types:
6+
- closed
7+
paths:
8+
- 'blossom_admin_member_ssp.xml'
9+
10+
# If a Pull Request updating the SSP is merged
11+
jobs:
12+
if_merged:
13+
if: github.event.pull_request.merged == true
14+
runs-on: ubuntu-20.04
15+
# permissions:
16+
# issues: write
17+
steps:
18+
- name: Run automated assessment
19+
run: echo "assessment"
20+
# query chaincode, code to execute on chaincode for list of supported roles, API command

‎.github/workflows/account_request_authorize.yaml

-28
This file was deleted.

‎.github/workflows/account_request_implement.yaml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: Account Request Implement
2+
3+
on:
4+
issues:
5+
types:
6+
- labeled
7+
8+
jobs:
9+
# When ACCOUNT_IMPLEMENTED label is added to account management request
10+
request-implemented:
11+
if: github.event.label.name == 'ACCOUNT_IMPLEMENTED'
12+
runs-on: ubuntu-20.04
13+
permissions:
14+
issues: write
15+
steps:
16+
- name: Notify Blossom Assessors about Implemented Account
17+
run: gh issue comment "$NUMBER" --body "$BODY"
18+
env:
19+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
20+
GH_REPO: ${{ github.repository }}
21+
NUMBER: ${{ github.event.issue.number }}
22+
BODY: >
23+
@usnistgov/blossom-assessors An edit to the ACL and/or SSP has been implemented.
24+
Please monitor the automated assessment.

‎.github/workflows/account_request_open.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -22,5 +22,5 @@ jobs:
2222
NUMBER: ${{ github.event.issue.number }}
2323
BODY: >
2424
Account management request CREATED.
25-
@blossom-management please review and approve/reject this request
26-
by adding ACCOUNT_APPROVED or ACCOUNT_REJECTED label.
25+
@usnistgov/blossom-management please review and approve/reject this request
26+
by adding ACCOUNT_APPROVED or ACCOUNT_REJECTED label to this issue.

‎.github/workflows/account_request_reject.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,11 @@ jobs:
1414
issues: write
1515
steps:
1616
- name: Close rejected account request
17-
run: gh issue close "$NUMBER" --comment "$COMMENT"
17+
run: gh issue close "$NUMBER" --comment "$COMMENT" --reason "not planned"
1818
env:
1919
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2020
GH_REPO: ${{ github.repository }}
2121
NUMBER: ${{ github.event.issue.number }}
2222
COMMENT: >
2323
Account management request REJECTED by Blossom Management.
24-
Closing request.
24+
Closing request as "not planned".

‎.github/workflows/account_workflow.md

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Account Management Workflow
2+
3+
This document explains the workflow of GitHub actions used to automate Blossom service's accounts management.
4+
5+
## Requirements to run Actions
6+
- [ ] Repository secrets: AWS_ACCESS_KEY, AWS_SECRET_KEY, AWS_REGION, AWS_BUCKET
7+
- [ ] Issue labels: ACCOUNT_REQUEST_RECORD, ACCOUNT_APPROVED, ACCOUNT_REJECTED, ACCOUNT_IMPLEMENTED
8+
9+
## Account Request and Creation
10+
- [ ] The requester requests an account for the Account Holder by creating a new GitHub issue using the Account Request Form.
11+
- [ ] The Blossom Management group is automatically notified to review the request through GitHub.
12+
- [ ] One of the Blossom Management (a member of the Blossom Management group) reviews the request and adds a new label to the issue: ACCOUNT_APPROVED or ACCOUNT_REJECTED
13+
- [ ] If ACCOUNT_REJECTED, the account request issue is automatically closed.
14+
- [ ] If the account is approved and the label ACCOUNT_APPROVED is added, the Blossom Sysdevs group is automatically notified about implementation.
15+
- [ ] A YAML file is automatically created from information submitted through the Account Request Form, which is pushed to the GitHub repo as a new branch and a condensed version is sent to S3 bucket.
16+
- [ ] S3 bucket receives the file about the new user to create and sends a trigger to EC2, which implements the new user in Cognito, SSM, ACL, AMB as necessary.
17+
- [ ] The new user is inserted into the SSP, which is pushed into the GitHub repo to the new branch.
18+
- [ ] Upon completion of creating the account requested, a Pull Request is automatically created, to link the branch with the Account Request issue.
19+
- [ ] Upon merging the Pull Request that implements the account, the relevant updated controls are re-assessed automatically. The Blossom Assessors group is then notified to monitor the automated assessment.
20+
- [ ] TBD: STEPS FOR AUTOMATED ASSESSMENT
21+
22+
## Account Disable
23+
[TBD]
24+
25+
## Account Enable
26+
[TBD]
27+
28+
## Account Change
29+
[TBD]
30+
31+
## Account Deletion
32+
[TBD]

‎.gitignore

+3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
.DS_Store
22
.vscode/*
3+
.history/*
34
*.pyc
45
__pycache__/
56
draft-*
@@ -9,3 +10,5 @@ draft-*
910
.pyenv*
1011
.env*
1112
oscal-cli.txt
13+
# Ignore validation tool oscal-cli
14+
build/oscal-cli

0 commit comments

Comments
 (0)