RBAC

Moved from Jira: Overview

Introduce a comprehensive Role-Based Access Control system to the Chariot platform. This system will ensure that users and services can only perform actions and access data for which they are explicitly authorized, based on centrally defined roles (Praetorian Admin, Praetorian, Admin, User, Contributor, Customer Reader) and policies. This epic covers identity integration, policy definition, enforcement across API gateways and services, initial role/permission setup, role management capabilities, and audit logging for RBAC events.

Design

• Utilize existing AWS Cognito for identity management.
• Define roles as Cognito Groups: PraetorianAdmin, Praetorian, Admin, User, Contributor, CustomerReader
• The Customer Reader role provides read-only access to platform data for external customer stakeholders. Customer Readers can view assets, risks, and reports but cannot modify configurations, trigger scans, or manage users.
• Use Open Policy Agent (OPA) for centralized policy decisions.
• Implement Policy Enforcement Points (PEPs) using AWS Lambda Authorizers for the main API Gateway and gRPC Interceptors for the Janus service.
• Store OPA policies (Rego) in a version-controlled repository.
• Develop APIs and UI components for role management by authorized personnel.
• Implement audit logging for RBAC-related events.
• UI/X: Backend RBAC enforcement, plus UI for role management and conditional rendering of features based on user permissions.

Acceptance Criteria (for the Epic):

• The 6 core roles (Praetorian Admin, Praetorian, Admin, User, Contributor, Customer Reader) are implemented and users can be assigned to them.
• The Customer Reader role enforces read-only access across all platform APIs and features.
• Permissions for each role (as outlined in the original Epic's MVP) are enforced for key platform APIs and features.
• Praetorian Admins and Admins can manage roles within their respective scopes.
• UI conditionally displays features based on user roles.
• Unauthorized access attempts are denied and logged.
• Audit logs capture role changes and significant permission-based actions.
• The system is designed to accommodate future roles and permission refinements.
• User Roles (Implementing / Impacted by RBAC): Praetorian Admin, Praetorian, Admin, User, Contributor, Customer Reader, Backend Engineers, Cloud Engineers, Frontend Engineers.

See attachements for old Jira ticket context. Some of this may be irrelevant now.

RBAC-jira-epic.txt

RBAC-develop-shared-lambda-authorizer-for-api-gateway.txt

RBAC Define Roles in AWS Cognito.txt

RBAC Setup OPA Instance & Initial Policy Bundle.txt

RBAC Integrate Lambda Authorizer with Administrative AP.txt

RBAC Expanding RBAC & Janus Integration.txt

Expand OPA Policies for More Granular Control & Ro.txt

RBAC UI Adaptation for RBAC.txt

RBAC Audit Logging for RBAC Events.txt

RBAC API End-Points for Role Management.txt