Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add leveraged-authorization-has-valid-impact-level Constraint #913

Merged
merged 6 commits into from
Dec 2, 2024
Merged

Add leveraged-authorization-has-valid-impact-level Constraint #913

merged 6 commits into from
Dec 2, 2024

Conversation

Gabeblis
Copy link
Contributor

Committer Notes

Purpose

This PR adds a constraint to ensure that a digital authorization package maintains appropriate FIPS-199 impact levels for leveraged authorizations within an SSP. This update helps avoid pass-back errors by aligning with the system's security sensitivity level (e.g., low, moderate, or high).

Changes

  • Added a new expect constraint to check that all leveraged authorizations define the appropriate FIPS-199 impact level (low, moderate, or high).
  • Edited ssp-all-VALID.xml to have proper data to trigger the constraint and pass.
  • Added an invalid test data file to trigger the constraint and demonstrate a successful fail
  • Added pass and fail YAML files for the constraint.

All Submissions:

  • Have you selected the correct base branch per Contributing guidance?
  • Have you set "Allow edits and access to secrets by maintainers"?
  • Have you checked to ensure there aren't other open Pull Requests for the same update/change?
  • Have you squashed any non-relevant commits and commit messages? [instructions]
  • Have you added an explanation of what your changes do and why you'd like us to include them?
    - [ ] If applicable, have all FedRAMP Documents Related to OSCAL Adoption affected by the changes in this issue have been updated.? Documentation already exists
  • If applicable, does this PR reference the issue it addresses and explain how it addresses the issue?

By submitting a pull request, you are agreeing to provide this contribution under the CC0 1.0 Universal public domain dedication.

@Gabeblis Gabeblis self-assigned this Nov 19, 2024
@Gabeblis Gabeblis requested a review from a team as a code owner November 19, 2024 13:06
@Gabeblis Gabeblis linked an issue Nov 19, 2024 that may be closed by this pull request
Check for impact level of leveraged authorizations in a SSP #888
Open
18 tasks
@Gabeblis Gabeblis changed the title Add leveraged-authorization-matches-impact-level constraint Add leveraged-authorization-has-valid-impact-level constraint Nov 20, 2024
@Gabeblis Gabeblis force-pushed the constraints/leveraged-authorization-impact-level branch 4 times, most recently from dd9dc71 to cf28b02 Compare November 20, 2024 16:22
@Gabeblis Gabeblis force-pushed the constraints/leveraged-authorization-impact-level branch from 45f01c4 to e98cbd0 Compare November 20, 2024 18:49
@Gabeblis Gabeblis changed the title Add leveraged-authorization-has-valid-impact-level constraint Add leveraged-authorization-has-valid-impact-level Constraint Nov 20, 2024
@Gabeblis Gabeblis force-pushed the constraints/leveraged-authorization-impact-level branch from e98cbd0 to a485fe4 Compare November 20, 2024 20:24
@Gabeblis Gabeblis requested a review from a team November 20, 2024 20:26
wandmagic
wandmagic previously approved these changes Nov 20, 2024
View reviewed changes
Copy link

@wandmagic wandmagic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good nice work

aj-stein-gsa
aj-stein-gsa requested changes Nov 20, 2024
View reviewed changes
Copy link
Contributor

@aj-stein-gsa aj-stein-gsa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks very solid but would like the documentation change to match.

src/validations/constraints/fedramp-external-constraints.xml Show resolved Hide resolved
@Gabeblis Gabeblis mentioned this pull request Nov 22, 2024
Merged
@Gabeblis Gabeblis requested review from aj-stein-gsa and a team November 22, 2024 14:46
aj-stein-gsa
aj-stein-gsa previously approved these changes Nov 22, 2024
View reviewed changes
Copy link
Contributor

@aj-stein-gsa aj-stein-gsa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Very good work, I particularly enjoy how you document the scenarios in your passing and failing test cases over the last few weeks. Keep it up!

@Gabeblis Gabeblis dismissed stale reviews from aj-stein-gsa and wandmagic via a403c4b November 25, 2024 14:30
@Gabeblis Gabeblis force-pushed the constraints/leveraged-authorization-impact-level branch 2 times, most recently from 423dc35 to 2d17552 Compare November 25, 2024 14:39
wandmagic
wandmagic previously approved these changes Nov 25, 2024
View reviewed changes
Rene2mt
Rene2mt previously approved these changes Nov 25, 2024
View reviewed changes
Copy link
Member

@Rene2mt Rene2mt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me.

@Gabeblis Gabeblis dismissed stale reviews from DimitriZhurkin, Rene2mt, and wandmagic via c89f710 November 29, 2024 15:28
@Gabeblis Gabeblis force-pushed the constraints/leveraged-authorization-impact-level branch 2 times, most recently from 31f0ee4 to bf5b3bf Compare November 29, 2024 15:45
@Gabeblis Gabeblis requested review from Rene2mt, wandmagic, DimitriZhurkin and a team November 29, 2024 16:44
@Gabeblis Gabeblis force-pushed the constraints/leveraged-authorization-impact-level branch from bf5b3bf to e694da4 Compare November 29, 2024 16:53
aj-stein-gsa
aj-stein-gsa previously approved these changes Nov 29, 2024
View reviewed changes
wandmagic
wandmagic previously approved these changes Dec 2, 2024
View reviewed changes
@Gabeblis Gabeblis dismissed stale reviews from wandmagic and aj-stein-gsa via 0945578 December 2, 2024 16:29
aj-stein-gsa
aj-stein-gsa approved these changes Dec 2, 2024
View reviewed changes
Copy link
Contributor

@aj-stein-gsa aj-stein-gsa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review acceptance criteria and related documentation updates to the website in GSA/automate.fedramp.gov#124, looks good to go. 🚢

@aj-stein-gsa aj-stein-gsa dismissed DimitriZhurkin’s stale review December 2, 2024 19:06

Outdated given changes.

@aj-stein-gsa aj-stein-gsa merged commit b82c417 into GSA:develop Dec 2, 2024
6 checks passed
wandmagic added a commit to wandmagic/fedramp-automation that referenced this pull request Dec 11, 2024
@wandmagic
Squashed commit of the following:
d5f6fc4 
commit f010473
Author: wandmagic <156969148+wandmagic@users.noreply.github.com>
Date:   Tue Dec 10 15:08:00 2024 -0500

    re-introduce implemented-requirements constraints (GSA#981)

    * re-introduce implemented-requirements constraints

    * add doc available check for health url

    * fix spacing

    * Update src/validations/constraints/fedramp-external-constraints.xml

    Co-authored-by: Gabeblis <gabriel.rodriguez@gsa.gov>

    * Update src/validations/constraints/fedramp-external-constraints.xml

    Co-authored-by: Gabeblis <gabriel.rodriguez@gsa.gov>

    ---------

    Co-authored-by: Gabeblis <gabriel.rodriguez@gsa.gov>

commit c0ad00e
Author: Gabeblis <gabriel.rodriguez@gsa.gov>
Date:   Mon Dec 9 17:17:47 2024 -0500

    Adjust link for all profiles (GSA#979)

commit 8561600
Author: Gabeblis <gabriel.rodriguez@gsa.gov>
Date:   Mon Dec 9 11:27:48 2024 -0500

    Add Components To `information-type-800-60-v2r1` Allowed Values (GSA#973)

    * Add Leveraged Authorizations and External, Interconnected, and Unauthorized Systems components to information-type allowed values

    * Adjust constraint target

commit 788b67e
Author: Gabeblis <gabriel.rodriguez@gsa.gov>
Date:   Mon Dec 9 09:32:35 2024 -0500

    Fix constraint targets (GSA#974)

commit 9d7946c
Author: A.J. Stein <alexander.stein@gsa.gov>
Date:   Fri Dec 6 17:10:04 2024 -0500

    [chore] Update container image to cli v2.4.0 (GSA#971)

commit b2c9712
Author: Gabeblis <gabriel.rodriguez@gsa.gov>
Date:   Fri Dec 6 15:26:04 2024 -0500

    Add `used-by-link-references-component` constraint (GSA#972)

    * Add 'used-by-link-references-component' constraint

    * Fix message

    Co-authored-by: Kylie Hunter <kylie.hunter@gsa.gov>

    * fix message

    Co-authored-by: DimitriZhurkin <dimitri.zhurkin@noblis.org>

    ---------

    Co-authored-by: Kylie Hunter <kylie.hunter@gsa.gov>
    Co-authored-by: DimitriZhurkin <dimitri.zhurkin@noblis.org>

commit 3dac668
Author: Gabeblis <gabriel.rodriguez@gsa.gov>
Date:   Fri Dec 6 13:43:16 2024 -0500

    Add `component-has-used-by-link` constraint (GSA#970)

    * Add constraint 'protocol-has-used-by-link'

    * Fix message

    * Change constraint id

    * Fix message (last time)

    * Update src/validations/constraints/content/ssp-component-has-used-by-link-INVALID.xml

    Co-authored-by: A.J. Stein <aj@gsa.gov>

    ---------

    Co-authored-by: A.J. Stein <aj@gsa.gov>

commit c3db2b2
Author: DimitriZhurkin <dimitri.zhurkin@noblis.org>
Date:   Thu Dec 5 13:07:39 2024 -0700

    Add inter-boundary-component-has-direction constraint (GSA#930) (GSA#968)

commit 5d6710f
Author: Gabeblis <gabriel.rodriguez@gsa.gov>
Date:   Thu Dec 5 13:32:28 2024 -0500

    Fix dev-constraint.js bug (GSA#967)

commit a7f9022
Author: Gabeblis <gabriel.rodriguez@gsa.gov>
Date:   Thu Dec 5 13:23:21 2024 -0500

    Add exists() to tests and remove duplicate constraint and fix system-implementation context (GSA#966)

    Remove duplicate constraint and fix system-implementation context

commit 780b38a
Author: wandmagic <156969148+wandmagic@users.noreply.github.com>
Date:   Thu Dec 5 12:50:29 2024 -0500

    Hotfix/deprecate all valid (GSA#960)

    * deprecate ssp-all-valid

    * Update src/validations/constraints/content/ssp-has-network-architecture-diagram-link-href-target-VALID-1.xml

    Co-authored-by: A.J. Stein <aj@gsa.gov>

    * Update src/validations/constraints/content/ssp-has-authorization-boundary-diagram-link-href-target-VALID-1.xml

    Co-authored-by: A.J. Stein <aj@gsa.gov>

    * Update src/validations/constraints/content/ssp-has-data-flow-diagram-link-href-target-VALID-1.xml

    Co-authored-by: A.J. Stein <aj@gsa.gov>

    * Update src/validations/constraints/content/ssp-has-network-architecture-diagram-link-href-target-VALID-1.xml

    Co-authored-by: A.J. Stein <aj@gsa.gov>

    * Update fedramp-ssp-example.oscal.xml

    ---------

    Co-authored-by: A.J. Stein <aj@gsa.gov>

commit 2c0e4de
Author: Gabeblis <gabriel.rodriguez@gsa.gov>
Date:   Thu Dec 5 10:21:00 2024 -0500

    Change cia-has-selected test (GSA#965)

commit 9a8e155
Author: wandmagic <156969148+wandmagic@users.noreply.github.com>
Date:   Wed Dec 4 15:30:29 2024 -0500

    Update fedramp-ssp-example.oscal.xml (GSA#959)

commit 5f7ce81
Author: Gabeblis <gabriel.rodriguez@gsa.gov>
Date:   Tue Dec 3 23:38:31 2024 +0000

    change example ssp location

commit 56f399e
Author: Gabeblis <gabriel.rodriguez@gsa.gov>
Date:   Tue Dec 3 23:23:59 2024 +0000

    Edit content to make constraints pass

commit d521a22
Author: Gabeblis <gabriel.rodriguez@gsa.gov>
Date:   Tue Dec 3 19:12:01 2024 +0000

    Delete extra ssp

commit 8cfb601
Author: Gabeblis <gabriel.rodriguez@gsa.gov>
Date:   Tue Dec 3 17:39:38 2024 +0000

    Add example ssp to content file and edit constraint script to point yaml pass file to example ssp

commit ff8f812
Author: ~ . ~ <paul.n.wand@gsa.gov>
Date:   Tue Dec 3 13:50:22 2024 -0500

    fix ssp to pass tests

commit 85ec424
Author: Gabeblis <gabriel.rodriguez@gsa.gov>
Date:   Tue Dec 3 17:17:18 2024 +0000

    Add example ssp to content file and edit constraint script to point yaml pass file to example ssp

commit 7312686
Author: Kylie Hunter <kylie.hunter@gsa.gov>
Date:   Mon Nov 25 16:15:01 2024 -0700

    Add connection-security prop constraint for GSA#931

commit 6ccb539
Author: Gabeblis <gabriel.rodriguez@gsa.gov>
Date:   Tue Dec 3 16:39:47 2024 -0500

    Add `issue-893` Constraints (GSA#949)

    * Add component-has-non-provider-responsible-role and tests

    * Add constraints and tests

    * Edit message

commit dd3be5f
Author: wandmagic <156969148+wandmagic@users.noreply.github.com>
Date:   Tue Dec 3 16:39:32 2024 -0500

    remove rev4 constraints (GSA#954)

commit 113c4f5
Author: Gabeblis <gabriel.rodriguez@gsa.gov>
Date:   Tue Dec 3 15:42:43 2024 -0500

    Fix Bug Issue GSA#940 (GSA#951)

commit c6f8e8f
Author: wandmagic <156969148+wandmagic@users.noreply.github.com>
Date:   Tue Dec 3 13:08:35 2024 -0500

    implementation point constraint (GSA#936)

    * implementation point constraint

    * add help uri

    * improve constraint

    * add extra fail content

    * Update src/validations/constraints/content/ssp-all-VALID.xml

    Co-authored-by: DimitriZhurkin <dimitri.zhurkin@noblis.org>

    * Update fedramp-external-constraints.xml

    Co-authored-by: Rene Tshiteya <rene-claude.tshiteya@gsa.gov>

    * implementation point constraint

    * add help uri

    * improve constraint

    * add extra fail content

    * Update src/validations/constraints/content/ssp-all-VALID.xml

    Co-authored-by: DimitriZhurkin <dimitri.zhurkin@noblis.org>

    * Update fedramp-external-constraints.xml

    Co-authored-by: Rene Tshiteya <rene-claude.tshiteya@gsa.gov>

    * add needed props to all valid

    * rebase

    Co-Authored-By: A.J. Stein <aj@gsa.gov>

    * Update src/validations/constraints/fedramp-external-constraints.xml

    Co-authored-by: A.J. Stein <aj@gsa.gov>

    ---------

    Co-authored-by: DimitriZhurkin <dimitri.zhurkin@noblis.org>
    Co-authored-by: Rene Tshiteya <rene-claude.tshiteya@gsa.gov>
    Co-authored-by: A.J. Stein <aj@gsa.gov>

commit 1377478
Author: Gabeblis <gabriel.rodriguez@gsa.gov>
Date:   Tue Dec 3 08:57:37 2024 -0500

    Add `component-responsible-role-references-party` constraint (GSA#945)

    * Add constraint 'component-responsible-role-references-party' and tests

    * correct test

    * Rename constraint and adjust help-url

    * Edit message

    Co-authored-by: A.J. Stein <aj@gsa.gov>

    ---------

    Co-authored-by: A.J. Stein <aj@gsa.gov>

commit a8461fb
Author: ~ . ~ <paul.n.wand@gsa.gov>
Date:   Mon Dec 2 11:09:13 2024 -0500

    pin server + update oscal-js version

commit b82c417
Author: Gabeblis <gabriel.rodriguez@gsa.gov>
Date:   Mon Dec 2 14:07:05 2024 -0500

    Add `leveraged-authorization-has-valid-impact-level` Constraint (GSA#913)

    * Add leveraged-authorization constraint

    * rename constraint

    * fix constraint test

    * correct constraint test

    * Change 'http' to 'https'

    * Add level

commit 1db5f97
Author: Gabeblis <gabriel.rodriguez@gsa.gov>
Date:   Mon Dec 2 13:13:17 2024 -0500

    Constraints/cleanup constraints file (GSA#946)

    * clean up fedramp-external-constraints.xml

    * fix

    * Add message to fully-operational-date-type
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kyhu65867 kyhu65867 kyhu65867 approved these changes

@aj-stein-gsa aj-stein-gsa aj-stein-gsa approved these changes

@wandmagic wandmagic wandmagic approved these changes

@brian-ruf brian-ruf Awaiting requested review from brian-ruf

@Rene2mt Rene2mt Awaiting requested review from Rene2mt

@DimitriZhurkin DimitriZhurkin Awaiting requested review from DimitriZhurkin

Assignees

@Gabeblis Gabeblis

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Check for impact level of leveraged authorizations in a SSP
7 participants
@Gabeblis @brian-ruf @Rene2mt @wandmagic @DimitriZhurkin @aj-stein-gsa @kyhu65867