bcgov / bcgov/cloud-pathfinder

Test and fix any problem related to ECR Image Scanning

Open
#2,360 0 comments 0 reactions 1 assignee Claimed by @bruce-wh-li View on GitHub
ECF Forge Security Technology
Dominant language
Jinja
Stars
2
Forks
7
PR merge metrics
No merged PRs in 30d

Description

**Describe the Issue**
As a security analyst, I need to to test the ECR Image Scanning actions work as expected

**Additional Context**
- Some issue with Container Sample Apps OIDC hinders ECR Image creation in Tools Environment and container deployed in Dev Environments
- As of now, in ECF Forge Environment, I don't have valid ECR Image for container sample apps for testing.
- As a result, the OWASP Web App scanning is not testing the container apps
- As a result, the ECR Image is not available for scanning

This ticket is only possible if deployment of Container Sample App succeeded in ECF Forge again

**Acceptance Criteria**
- [ ] Update Github Repo Document
- [ ] Test OWASP Zap Scan
- [ ] Test ECR Scanning
.
.
.
.
.
.
.
.
.
.
.

**Extra Template Info**

***Definition of Ready***
These set of conditions will need to be met in order to bring a ticket into the sprint and start work. Protects the team from unclear requirements.
Issues (Task/Story/Spike) aligned to an EPIC and linked appropriately.
Assigned to the appropriate CPF MEMBER (and is not left blank in ZenHub) at the start of sprint (1st day of the sprint)
Acceptance has been defined for the issue and has been reviewed with CPF team and approved by the necessary approver.
Has been sized and estimated by the delivery team.
Detailed breakdown of the steps required to complete the story in the additional context
Any additional specifications have been documented, reviewed with CPF and approved by the necessary approver.

***Acceptance Criteria***
A set of pre-defined requirement that need to be met in order to mark the user story as “done”.
It should be testable with no room for interpretation
It should be either “pass” or “fail”
It should be clear enough for business stake holders to understand
As part of the user story, it should be written from the user perspective
A well written acceptance criteria is great for
- managing expectations
- defining scope
- reducing ambiguity
- establishing testing criteria for QA
Given (Pre-condition)
When (Action)
Then (Outcome)

***Definition of Done***
These set of conditions are met for work to be considered as complete on an issue.
All acceptance criteria(s) have been validated.
All the necessary documentation for the issue has been uploaded to Teams.
Functionality has been tested when applicable.
Functionality has been demonstrated to the relevant stakeholders (where applicable).
Story has been scheduled for a Sprint Demo/community update and impacted teams invited to the Demo.
Stories accepted by PO and documented for potential sharing with impacted users.
- Documented = Captured in Community Update (CU) deck
- Release notes = aspirational goal of providing a bulleted list of features and changes that our users can touch. Was going to store them in our Cloud Pathfinder repo. Can also display to users in the CU

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.