Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

adding documentation on cloudgov s3 incident response #2763

Merged
merged 2 commits into from
Dec 13, 2023

Conversation

ADPennington
Copy link
Collaborator

Summary of Changes

Adds documentation on TDP team's response to the cloud.gov S3 security incident in Oct 2023.
Pull request closes #2732

How to Test

List the steps to test the PR
These steps are generic, please adjust as necessary.

cd tdrs-frontend && docker-compose -f docker-compose.yml -f docker-compose.local.yml up -d
cd tdrs-backend && docker-compose -f docker-compose.yml -f docker-compose.local.yml up -d 
  1. Open http://localhost:3000/ and sign in.
  2. Proceed with functional tests as described herein.
  3. Test steps should be captured in the demo GIF(s) and/or screenshots below.

Demo GIF(s) and screenshots for testing procedure

Deliverables

More details on how deliverables herein are assessed included here.

Deliverable 1: Accepted Features

Checklist of ACs:

  • [insert ACs here]
  • lfrohlich and/or adpennington confirmed that ACs are met.

Deliverable 2: Tested Code

  • Are all areas of code introduced in this PR meaningfully tested?
    • If this PR introduces backend code changes, are they meaningfully tested?
    • If this PR introduces frontend code changes, are they meaningfully tested?
  • Are code coverage minimums met?
    • Frontend coverage: [insert coverage %] (see CodeCov Report comment in PR)
    • Backend coverage: [insert coverage %] (see CodeCov Report comment in PR)

Deliverable 3: Properly Styled Code

  • Are backend code style checks passing on CircleCI?
  • Are frontend code style checks passing on CircleCI?
  • Are code maintainability principles being followed?

Deliverable 4: Accessible

  • Does this PR complete the epic?
  • Are links included to any other gov-approved PRs associated with epic?
  • Does PR include documentation for Raft's a11y review?
  • Did automated and manual testing with iamjolly and ttran-hub using Accessibility Insights reveal any errors introduced in this PR?

Deliverable 5: Deployed

  • Was the code successfully deployed via automated CircleCI process to development on Cloud.gov?

Deliverable 6: Documented

  • Does this PR provide background for why coding decisions were made?
  • If this PR introduces backend code, is that code easy to understand and sufficiently documented, both inline and overall?
  • If this PR introduces frontend code, is that code easy to understand and sufficiently documented, both inline and overall?
  • If this PR introduces dependencies, are their licenses documented?
  • Can reviewer explain and take ownership of these elements presented in this code review?

Deliverable 7: Secure

  • Does the OWASP Scan pass on CircleCI?
  • Do manual code review and manual testing detect any new security issues?
  • If new issues detected, is investigation and/or remediation plan documented?

Deliverable 8: User Research

Research product(s) clearly articulate(s):

  • the purpose of the research
  • methods used to conduct the research
  • who participated in the research
  • what was tested and how
  • impact of research on TDP
  • (if applicable) final design mockups produced for TDP development

@ADPennington ADPennington added security compliance OCIO-related compliance tasks documentation labels Dec 1, 2023
@ADPennington ADPennington self-assigned this Dec 1, 2023
@ADPennington ADPennington marked this pull request as ready for review December 1, 2023 21:20
@ADPennington ADPennington added the raft review This issue is ready for raft review label Dec 1, 2023
Copy link

codecov bot commented Dec 1, 2023

Codecov Report

Merging #2763 (4f0e12e) into develop (e5ccc2c) will decrease coverage by 0.02%.
Report is 2 commits behind head on develop.
The diff coverage is n/a.

Additional details and impacted files

Impacted file tree graph

@@             Coverage Diff             @@
##           develop    #2763      +/-   ##
===========================================
- Coverage    92.80%   92.78%   -0.02%     
===========================================
  Files          246      246              
  Lines         5576     5575       -1     
  Branches       480      479       -1     
===========================================
- Hits          5175     5173       -2     
- Misses         308      309       +1     
  Partials        93       93              
Flag Coverage Δ
dev-backend 92.77% <ø> (-0.03%) ⬇️
dev-frontend 92.83% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files Coverage Δ
tdrs-backend/tdpservice/parsers/models.py 92.06% <ø> (-1.69%) ⬇️

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 68e2aba...4f0e12e. Read the comment docs.

@ADPennington ADPennington removed raft review This issue is ready for raft review QASP Review labels Dec 13, 2023
@andrew-jameson andrew-jameson merged commit 8028ad0 into develop Dec 13, 2023
17 checks passed
@andrew-jameson andrew-jameson deleted the doc/cloudgov-s3-irp branch December 13, 2023 17:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Operations - S3 Bucket rebind
3 participants