#7970
- [X] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)~
- ~[ ] Documented any permissions changes~
- ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)~
- ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.~
- [X] Added/updated tests
- [x] Manual QA for all new/changed functionality
- For Orbit and Fleet Desktop changes:
- [x] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- [x] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).
rename aws_iam_policy and aws_iam_policy_attachment resources to use
underscore instead of hyphen in their names. Also, change
aws_iam_policy_attachment to aws_iam_role_policy_attachment to match the
correct resource type.
## Addresses #11188
When an _already authenticated_ no-access user tries to access any
authenticated routes:
- Log the user out
- Display the 403 'Forbidden' error page
https://www.loom.com/share/358fd5b534984ab9ab40220986a7d094
The user _can_ still log in – see attached issue.
## Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`
- [x] Manual QA for all new/changed functionality
---------
Co-authored-by: Jacob Shandling <jacob@fleetdm.com>
feat(firehose): add Terraform documentation to README.md
feat(firehose): add Terraform module for IAM policy
feat(firehose): add Terraform output for IAM policy ARN
docs(byo-firehose-logging-destination): add introduction and explanation
of IAM role and policy
This commit adds an introduction and explanation of the IAM role and
policy defined in the Terraform code. Specifically, it explains that the
IAM role named `fleet_role` is being defined in the AWS account, and
that it will be assumed by the Fleet application being hosted. The
commit also explains that the IAM role is being given specific
permissions to perform certain actions on the Firehose service, and that
the associated IAM policy specifies the minimum allowed permissions.
Additionally, the commit explains that the Firehose service is KMS
encrypted, and that the IAM role needs permission to the KMS key being
used to encrypt the data going into Firehose. Finally, the commit
explains that the code sets up a secure and controlled environment for
the Fleet application to perform its necessary actions on the Firehose
service within the AWS account.
refactor(byo-firehose-logging-destination): reformat table of resources
and inputs
feat(byo-firehose-logging-destination): add KMS key resource for
firehose encryption
feat(byo-firehose-logging-destination): add S3 bucket resource for
logging destination
feat(byo-firehose-logging-destination): add IAM policy and role
resources for firehose
feat(byo-firehose-logging-destination): add IAM policy attachment
resource for fleet-firehose policy
feat(byo-firehose-logging-destination): add data source for current AWS
region
feat(byo-firehose-logging-destination): add data source for KMS alias
feat(byo-firehose-logging-destination): add data source for IAM policy
documents
feat(byo-firehose-logging-destination): add outputs for firehose IAM
role, delivery streams, and S3 bucket
fix(iam.tf): change aws_iam_policy and aws_iam_policy_attachment
resource names to include fleet prefix
closes https://github.com/fleetdm/fleet/issues/11331
#11089
- [X] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)~
- [X] Documented any permissions changes
- ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)~
- ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.~
- [x] Added/updated tests
- [X] Manual QA for all new/changed functionality
- ~For Orbit and Fleet Desktop changes:~
- ~[ ] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.~
- ~[ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
Changes made based on feedback during MDM beta session.
- Correction: the URL doesn't have to be publicly accessible
- Clarify how to install the bootstrap package on a team v. "No
team"
- Add confirmation step
Deploying `fleetdm/fleet:main` directly to dogfood has problems if
migrations are needed and an image restarts. This causes crashloops in
the containers and leads to being rate-limited for pulls on dockerhub.
Warn against this and also suggest using quay.io as an alternative image
location.
Related to #10741, this adds a new key to app config named
`end_user_authentication`, which can be configured using the same keys
as the existing SSO feature.
Per the spec, if the feature is configured, it's implicitly enabled, at
least until we get to #10999.
Note that this only enables the SSO config, a second part of the ticket
with endpoints for the EULA will be tackled separately.
This test was failing because we can send other commands when a DEP
device is enrolling (eg: to install a bootstrap package) and the test
was assuming that the first command we'll always get is the command to
install `fleetd`.
We have discussed in the past (@gillespi314 suggested that is important)
increasing the accuracy of the timestamps in the `nano_commadns` table,
which is the proper fix for this.
## Addresses #11088
Updated solution:
https://www.loom.com/share/e3ca30bebde54df5b8cbd8cac6d26780
- First refresh displays the bug: a white bar at the top of the page as
the login page loads.
- Second refresh displays the login page with the bug gone
- Navigate at the end to an error page to confirm it is unaffected,
since the initial solution affected the background color of those pages
## Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`
- [x] Manual QA for all new/changed functionality
---------
Co-authored-by: Jacob Shandling <jacob@fleetdm.com>
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)
- [ ] Documented any permissions changes
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.
- [ ] Added/updated tests
- [ ] Manual QA for all new/changed functionality
- For Orbit and Fleet Desktop changes:
- [ ] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- [ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)
- [ ] Documented any permissions changes
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.
- [ ] Added/updated tests
- [ ] Manual QA for all new/changed functionality
- For Orbit and Fleet Desktop changes:
- [ ] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- [ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).
- Add sentence to explain that Fleet installs fleetd automatically on
hosts
- Add sentence to explain that setup features require ABM
- On MDM macOS settings page, add sentence that explains that Fleet
automatically deploys a "Fleetd configuration" profile.
```
go get -u go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux go.opentelemetry.io/otel go.opentelemetry.io/otel/exporters/otlp/otlptrace go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc go.opentelemetry.io/otel/sdk; go mod tidy
```
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)
- [ ] Documented any permissions changes
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.
- [ ] Added/updated tests
- [ ] Manual QA for all new/changed functionality
- For Orbit and Fleet Desktop changes:
- [ ] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- [ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).
In #10338 we introduced logic to gate DEP profiles behind Okta auth
using the ROP flow.
We're not going to use that, and instead we're going to gate profiles
behind SSO, which can be used from multiple providers and supports SSO
(the initial motivation behind the ROP flow was to create a local user
account.)
This removes some of the old code, which was never used in
production/documented for the public to use.
At the moment I'm leaving the `mdm_idp_accounts` table and related
methods untouched, as it's unclear yet if we're going to need a similar
auxiliar table, and I would rather deal with the migrations all at once.
Lucas Manuel Rodriguez