Zilvinas Saltys

environment and dataset teams missing GET_ORGANIZATION permission

1

There was recently a fix for 2.3 related to how GET_ORGANIZATION permission works: https://github.com/data-dot-all/dataall/pull/1139 The summary of the issue is that if you are a member of an environment team...

share revoke should not fail when a role is deleted

4

We've ran into multiple situations where our users delete a role which is actively used in data.all. We can detect this (with custom scripts) and data.all will let you revoke...

Remove access without constraints on various policies

2

There are various policies installed by data.all granting unrestricted access to resources. This gets picked up by Checkov security scanner. By unrestricted I mean **granting actions on resource '*'**. This...

Remove wildcard from Access-Control-Allow-Origin header

9

Currently all graphql endpoints respond with header: Access-Control-Allow-Origin: *. This allows to make calls from other origins outside data.all domain. In reality this is very low or non existent security...

data.all permission table has incorrect permissions after install

1

### Describe the bug After we installed data.all 2.3 we noticed that we cannot view any team permissions in Admin console and were getting a JS error. This is because...

Upgrade lambdas using v16 Node.js runtime

6

Node.js v16 runtime is scheduled to be deprecated Jun 12, 2024. Therefore we should upgrade all lambdas to Node.js 20 runtime.

Remove access without constraints on the pivotRole

5

The pivot role installed on AWS accounts has policies which are picked up by Checkov scanner where the role has unrestricted access. By unrestricted I mean **granting actions on resource...

Implement metadata forms

16

AWS DataZone has a feature called: **Metadata Forms**. Essentially it's a dynamic form creator that can be attached to datasets. I think this is an excellent feature and it would...

Do not allow to register invalid teams for environments

1

Currently environment team invite page uses a different react component than the rest of the pages like environment linking and it allows to type any team name even if it...

Add cdk synth before running checkov security scans

1

Currently the github action is using checkov to scan data.all repo. However it cannot find much because most of the stacks are generated with CDK. We should generate the stacks...