Jon Chery
2e2064559a
---ci---
project: acdl
phase: 22-27
milestone: v1.7
status: verify
lessons:
- P0 fix: run_platform.sh check-only assertions were hardcoded to static-assets; generalized for all contracts
- P1 fix: URL-encode contractId in GitHub issue search to prevent query injection
- P1 fix: validate consumerRepo format against invoking principal identity (P1-2)
- P2 fix: tagging-standard.json description referenced .yaml instead of .py
- P2 fix: removed unused graph_resource_name_utils import in acdl_tagging.py
---/ci---
Multi-persona code review of the v1.7 milestone (130 files, +5568/-353).
P0 (1, auto-fixed):
- run_platform.sh --check-only hardcoded static-assets assertions broke
for other contracts (microservice). Generalized to structural checks.
P1 security fixes applied (2 of 9):
- P1-1: URL-encode contractId in GitHub search query (injection prevention)
- P1-2: Validate consumerRepo format (org/repo) when caller identity present
P1 flagged for post-hoc (7):
- P1-3: SSM uses AWS-managed key, not platform CMK (ACDL_KMS_KEY_ID not set)
- P1-4: WAF custom rules emit invalid HCL (attribute vs block syntax)
- P1-5: WAF default_action input silently ignored (always emits allow {})
- P1-6: consumer_invoke_policy.json has placeholder account ID (needs substitution)
- P1-7: L2 composition outputs section not implemented in resolver
- P1-8: terraform/spike/*.tf overwritten by run_platform.sh (state contamination)
- P1-9: GitHub API URLs hardcoded (Gitea deployments silently fail)
P2 nits fixed (2 of 8):
- P2-2: tagging-standard.json description referenced .yaml instead of .py
- P2-3: unused graph_resource_name_utils import removed
Tests: 275 passed (was 272; +3 caller identity validation tests).
46 lines
1.7 KiB
JSON
46 lines
1.7 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"$id": "https://acdl.dev/schemas/tagging-standard.json",
|
|
"title": "ACDL Tagging Standard",
|
|
"description": "Required tags for all taggable AWS resources created by the platform. Enforced by a Checkov custom Python rule (adapters/terraform/policy/custom_rules/acdl_tagging.py). The checkov adapter maps ACDL_TAG_NAMING as a real rule (D-054, D-043 closure).",
|
|
"type": "object",
|
|
"properties": {
|
|
"required_tags": {
|
|
"type": "object",
|
|
"description": "The set of tags that must be present on every taggable AWS resource.",
|
|
"properties": {
|
|
"acdl:owner": {
|
|
"type": "string",
|
|
"description": "The consumer repository name (e.g. 'consumer-repo'). Injected from the ABAC session."
|
|
},
|
|
"acdl:contract": {
|
|
"type": "string",
|
|
"description": "The contract ID (UUID)."
|
|
},
|
|
"acdl:environment": {
|
|
"type": "string",
|
|
"enum": ["dev", "qa", "prod", "dr"],
|
|
"description": "The environment name."
|
|
},
|
|
"acdl:cost-center": {
|
|
"type": "string",
|
|
"description": "The cost center (consumer-provided or platform-default 'acdl-default')."
|
|
}
|
|
},
|
|
"required": ["acdl:owner", "acdl:contract", "acdl:environment", "acdl:cost-center"],
|
|
"additionalProperties": false
|
|
},
|
|
"default_values": {
|
|
"type": "object",
|
|
"description": "Default values used when the consumer does not supply the tag.",
|
|
"properties": {
|
|
"acdl:cost-center": {
|
|
"type": "string",
|
|
"default": "acdl-default"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"required": ["required_tags"],
|
|
"additionalProperties": false
|
|
} |