nasa / nasa/Common-Metadata-Repository
CMR Subscription - No way to scope sender permissions
Nobody has claimed this yet.
- Dominant language
- Clojure
- Stars
- 397
- Forks
- 108
- Avg merge
- 3d 14m
- Merged PRs (30d)
- 13
Description
The documentation for setting up a CMR subscription instructs the user to create an SQS Queue that allows any SNS topic in all of AWS to send data to it. This is obviously a bad idea. The proper solution is to provide some additional information about the SNS topic that sends the data so that the user can set up their SQS Queue to only accept messages from that particular SNS topic.
https://wiki.earthdata.nasa.gov/spaces/CMR/pages/404522012/CMR+Ingest+Subscriptions
CMR should provide users some information about the sending SNS topic so we can restrict the senders allowed to our subscription SQS queues.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked CMR Ingest Subscriptions documentation and review how the SQS queue currently permits SNS senders. Identify the CMR SNS topic information users need, then update the guidance so a subscription queue can restrict messages to that topic. Done means the documentation specifies the sender clearly enough to configure a scoped permission.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100