Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Metadata Form Enforcement #1668

Closed
SofiaSazonova opened this issue Oct 28, 2024 · 3 comments
Closed

Metadata Form Enforcement #1668

SofiaSazonova opened this issue Oct 28, 2024 · 3 comments
Assignees

Comments

@SofiaSazonova
Copy link
Contributor

SofiaSazonova commented Oct 28, 2024

Enforcement

Metadata forms can be obligatory to fill in on different levels. User can select the metadata form and entity types, that should have this form attached. Enforcement affects selected entity types on all lower levels hierarchically.

Table E.1. Metadata form enforcement rule

Field Description Type Possible Values
Metadata Form Identifier of metadata form, that is enforced String URI of existing form
Metadata Form Version number of version, that is enforced Int
Level Level of affected entities. All lower levels will be affected. String From table E.2
Home Entity Uri If level is not global, the Uri of the entity under which the MF is enforced String
Entity Types Entity type affected by this enforcement Array [String] Identifiers of data.all entities types (table E.2)
Severity String Obligatory/Recommended

Table E.2. Metadata form levels’ hierarchy

meta levels

Who can enforce:

  • Data.all admins can enforce any form on any level across the platform. They have full control over metadata form enforcement.
  • Owners/admins of the data can enforce forms for this levels and levels below in the hierarchy. For example, an org admin can enforce a form for the org, all teams in that org, all environments in the org, all datasets in those environments, etc.
  • Share approvers and requestors can enforce forms for a specific share they are involved with. However, they can only delete enforcement rules they created themselves - they cannot delete rules created by others

So in summary, enforcement capabilities cascade along with administrative privileges in the hierarchy. Global admins have full control, org/env admins can enforce for their sphere and below, dataset admins for the datasets and items in it, and share requesters and approvers for a specific share.

How we enforce?

  1. When MF is enforced, but entity misses it, on entity page there is a HUGE reminder about it.
  2. If MF is mandatory, than NO actions are allowed until required MF is attached |
    2.1. Orgs:
  • ⛔ invite/remove groups
  • ⛔ link envs
  • ⛔ edit info

2.2. Envs

  • ⛔ invite/remove
  • ⛔ add consumption roles
  • ⛔ add datasets
  • ⛔ edit info

2.3. Datasets

  • ⛔ data actions (lauch crawler, add folders, delete tables, syncing data)
  • ⛔ create new shares. Existing shares are intact
  • ⛔ edit info
@SofiaSazonova SofiaSazonova self-assigned this Oct 28, 2024
@SofiaSazonova
Copy link
Contributor Author

SofiaSazonova commented Oct 28, 2024

MF DB

@SofiaSazonova
Copy link
Contributor Author

I think, we don't really need Item level. So, I'll remove it

@rbernotas
Copy link
Collaborator

@SofiaSazonova , how will this look if as a data.all admin, I want to enforce a Metadata Form for all datasets in data.all? Using Table E.1 as an example:

Metdata Form: the identifier of the metadata form to enforce
Version: the version of the form I'm going to enforce
Level: Global Level?
Home Entity: N/A
Entity Types: Dataset
Severity: Obligatory

Is this correct? In this case, the Form will be required for all Datasets in data.all? Is it then also required for all Buckets/Folders/Tables/Shares for all Datasets? Or would that only happen if "Entity Types" was "Dataset, Bucket, Folders, Tables, Shares"?

SofiaSazonova added a commit that referenced this issue Feb 12, 2025
### Feature or Bugfix
<!-- please choose -->
- Feature


### Detail
**MF view**
1. Enforcement rule tab is added
2. MF owner can add Enforcement rules, others can view
3. For each Enforcement rule user can see entities affected by it and if
the form is attached or not
4. Rule is automatically updated for latest MF versions when version is
created/deleted

**Entity view**
1. If any enforced forms are missing from entity 'Metadata' tab on it's
page has "alarm" icon
2. Missing MFs are highlighted  in the list of attached entities

**Backend**
1. New core component MetadataFormEntityManager. 
2. All eligible entities register in this manager, when their module is
enabled
3. This manager is unused if metadata form module is not created
4. Metadata form module depends on DatasetBase module, because we have
'Dataset' enforcement level and logic binded to it.

**IMPORTANT**
Before this PR is merged, I will deregister modules, which don't have
frontend for MF yet.

### Relates
- #1668 

### Security
Please answer the questions below briefly where applicable, or write
`N/A`. Based on
[OWASP 10](https://owasp.org/Top10/en/).

- Does this PR introduce or modify any input fields or queries - this
includes
fetching data from storage outside the application (e.g. a database, an
S3 bucket)?
  - Is the input sanitized?
- What precautions are you taking before deserializing the data you
consume?
  - Is injection prevented by parametrizing queries?
  - Have you ensured no `eval` or similar functions are used?
- Does this PR introduce any functionality or component that requires
authorization?
- How have you ensured it respects the existing AuthN/AuthZ mechanisms?
  - Are you logging failed auth attempts?
- Are you using or adding any cryptographic features?
  - Do you use a standard proven implementations?
  - Are the used keys controlled by the customer? Where are they stored?
- Are you introducing any new policies/roles/users?
  - Have you used the least-privilege principle? How?


By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license.

---------

Co-authored-by: Sofia Sazonova <sazonova@amazon.co.uk>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants