d63af51f84
Some checks failed
api-governance / spectral-lint (push) Has been cancelled
Docs CI / lint-and-preview (push) Has been cancelled
oas-ci / oas-validate (push) Has been cancelled
SDK Publish & Sign / sdk-publish (push) Has been cancelled
Policy Lint & Smoke / policy-lint (push) Has been cancelled
Policy Simulation / policy-simulate (push) Has been cancelled
devportal-offline / build-offline (push) Has been cancelled
39 lines
1.9 KiB
Markdown
39 lines
1.9 KiB
Markdown
# Export Hardening Guide
|
|
|
|
Status: Draft (2025-11-26) — DOCS-EXPORT-37-004.
|
|
|
|
## Scope
|
|
Protect export flows (Export Center, Graph exports, SBOM exports) in online and air-gapped deployments.
|
|
|
|
## RBAC & tenancy
|
|
- Enforce `export:*` scopes per service:
|
|
- Graph: `graph:export`
|
|
- Export Center: `export:read`, `export:write`
|
|
- SBOM: `sbom:export`
|
|
- Require `X-Stella-Tenant` on every export request; deny if missing/mismatched.
|
|
- Default deny cross-tenant access even for admins.
|
|
|
|
## Encryption & integrity
|
|
- All exports must include SHA256 (and size) headers; prefer DSSE manifest for multi-file bundles.
|
|
- When storing or staging bundles, encrypt at rest (KMS or sealed disk); in air-gap, keep CMK/KEK offline-ready.
|
|
- For downloadable endpoints, set `X-Content-SHA256`; clients must verify hash before use.
|
|
|
|
## Redaction & minimization
|
|
- Default exclude secrets, tokens, and credentials from exports; add allowlist only when required.
|
|
- For policy/VEX overlays, strip explain traces unless explicitly requested.
|
|
- Include only tenant-scoped data; avoid global caches in exported bundles.
|
|
|
|
## Network & paths
|
|
- Disallow direct external URLs in exports; use content-addressed blobs or gateway download paths.
|
|
- In air-gap mode, block egress during export and rely on local object storage.
|
|
- Set `Content-Security-Policy: sandbox` for HTML/PNG exports where applicable.
|
|
|
|
## Imposed rule reminder
|
|
- Follow platform “imposed rule” banner: **No external distribution without cryptographic integrity + tenant proof.**
|
|
- Every export must be reproducible: document source snapshot IDs, overlay versions, tool version, and hash.
|
|
|
|
## Runbook (abridged)
|
|
- If hash mismatch: stop distribution, regenerate export, open incident with bundle hash and source snapshot IDs.
|
|
- If RBAC failure spike: check gateway policy and scope mappings; verify tenant header presence in clients.
|
|
- Air-gap: verify bundle catalog signatures before ingest; reject if trust root mismatches.
|