Policy Driven SLA

Use CbPolicy engine to enforce SLA.

Mario Toffia mario.toffia@crossbreed.se

AWS Policy Support (Short Version)

Policy Enforcement

  • Control Tower/Organizations

    • Service Control Policies

    • Guard Rails / AWS Config

  • Account Level

    • AWS Config

    • IAM Policies

SCP are hierarchical externalized policy tree that accounts cannot override!

CbCDK [1]

  • CDK-nag [2] for CbCDK

  • Extensible

    • Built-in rule sets for

      • AWS Well Architected Solution, HIPAA

      • NIST 800 54 revision 4 & 5, PCI DSS 3.2.1

1. Crossbreed Cloud Development Kit
2. Infrastructure code conforms to policies

Audit & Compliance

  • AWS Audit Manager [1]

    • Automated evidence collection

      • AWS Built-in

      • CEOS Audit System [2]

  • AWS Security Hub [3]

    • AWS Built-in and CEOS Audit System

1. Automated audit and compliance checks
2. Internally sources from GitHub, IMS, O365…​
3. Security findings and automated responses

CbPolicy Engine

Data Plane

Fully Integrated

  • Embedded in each service for zero latency

  • Allows for static & dynamic policies [1]

  • Based on OPA [2]

Dynamic are banned! To do forensic, static environment is king! [3]
1. DynamoDB policy PRP support
2. Open Policy Agent - https://www.openpolicyagent.org
3. We use CloudFormation to redeploy policy changes (many times a day)!

Modeled after XACML3 standard

Data to Process

{
  "tz": "Europe/Stockholm",
  "sensors": {
    "ACTODT": {"v":13.1, "t": 1667323116},
    "MPST":   {"v":70.0, "t": 1667323116},
    "ODT":    {"v":14.0, "t": 1667323116},
    "RSHCT":  {"v":26.4, "t": 1667323116},
    "IDT_O1": {"v":22.9, "t": 1567323116},
    "IDT_O2": {"v":-999, "t": 1667323116},
  }
}

Additional Data

{
  "range": {"IDT**": [-10, 100], "ODT**": [-70, 150]},
	"ts": {
    "IDT**": { "drop": 3600, "report": 14400},
    "ODT": {"drop": 43200, "report": 21600}
  },
  "report": ["ODT", "IDT_O3**"],
  "skip": ["IDT**"]
}

Rego (Deny)

package svinbound

deny[dp] = msg {
	my := input.sensors[dp]
    my == "$error"

    not obligation[dp]

    msg := sprintf("failed to import sensors.%s due to errors", [dp])
}

Rego (Obligation)

obligation[dp] = ob {
  my := input.sensors[dp]
	my != "$error"

  matchSkip(dp)
  not matchReport(dp)

  range := get_range(dp)
	not in_range(my, range[0], range[1])

  ob := {
    "deny": sprintf("not in range: %v - %v", [range, my]),
    "infosec": "plc",
    "remove": sprintf("sensors.[%s]", [dp])
  }
}

Policy Context

  • Static - service context

    • Base PDP, PEP, PRP

  • Invocation Context

    • May override augment static context

    • Per LocationID, type of data, etc.

CbPolicy Engine Usage

Currently Limited Usage

  • Only actively used

    • Eastbound Provider SDK

    • Will be integrated into West, South, North

  • Will be instrumented in all services

    • Core Services

    • Crossbreed Smarter "*" Services

    • Customer Own Services

Pipe Definition

{
	"sensor-values": {
		"set-provider" : {
			"source" : "asmap(src.Values, 'ID')"
		},
    // ...
		"gen-gen-ds": {{generate}},
		"policy-pep-ds": {
			"policy" : "svinbound/ds",
			"data": { "": "policydata.sv" },
			"input": "[target]"
		},
		"marshal-marshal-ds": {{marshal "marshal(_ts.dsv, target)"}}
	}
}

Policy Data

{
  "range": {"IDT**": [-10, 100], "ODT**": [-70, 150]},
	"ts": {
    "IDT**": { "drop": 3600, "report": 14400},
    "ODT": {"drop": 43200, "report": 21600}
  },
  "report": ["ODT", "IDT_O3**"],
  "skip": ["IDT**"]
}

PDP Reference

{
  "policyset": {
    "root": {
      "policies": { "svinbound": ["svinbound"] }
    }
  },
  "registrations": [
  {
    "method": "PROCESS", "path": ["svinbound","ds"],
    "policies": {
      "process": "svinbound"
    },
    "queries": { "process": "data.svinbound" }
  }]
}

Full Pipe

{
  "sensor-values": {
		"set-provider" : { "source" : "asmap(src.Values, 'ID')" },
    "set-mapping": {
      "generate.IDT_O2": {
        "e": "source['1!N3ASTFSZH7ZS23P']", "f": true
      },
      // ...
    },
    "gen-gen-ds": { "target": "[sv]", "mode": "error-report" },
    "policy-pep-ds": {
      "policy" : "svinbound/ds",
      "data": { "": "policydata.sv" }, "input": "[target]"
    },
    "marshal-marshal-ds": { "target": "marshal(_ts.dsv, target)" }
  }
}

Generator Template

{
  "tz": TZ,
	"sensors": {
    "IDT_O1": float64(generate["IDT_O1"].Value),
    "IDT_O2": float64(generate["IDT_O2"].Value),
    "IDT_O3": float64(generate["IDT_O3"].Value),
    "IDT_O4": float64(generate["IDT_O4"].Value),
    "OFFODT": float64(generate["OFFODT"].Value),
    "ODT": float64(generate["ODT"].Value)
  }
}

Config

{
  "profile": "generic",
  "prms": {
    "MID": "IDT_O1 IDT_O2 IDT_O3 IDT_O4 OFFODT ODT",
    "CRD": "***", "BID": "Måssmyren 18",
    "TID": "1", "PID": "1234"
  }
}

Fetched Values

{
	"totalCount": 101,
	"values": {
    "P49b5721b-be72-4d56-9537-c98ad0ea2e1c;1!N3ASTFSZHI2WD0F": {
      "value": -999
    },
	  "P49b5721b-be72-4d56-9537-c98ad0ea2e1c;1!N3ASTFSZH7ZS23P": {
      "value": -1.2
    }
    // ...
	}
  }

Outputs

{
  "tz": "Europe/Stockholm",
	"sensors": {
    "IDT_O2": 15,
    "IDT_O3": 32,
    "IDT_O4": 40,
    "OFFODT": -1.2,
    "ODT": 20
  }
}

Policy Driven SLA Monitoring

Goals

  • Static SLA verification & compilation

  • Compose & decompose for different purposes

    • Monitoring

    • Data & configuration import/export

    • Operational data/alarm/metrics export

    • …​

Automatic hence no errors!

SLA Policy Categories

Service "glitches" ie. up/down frequently or response times.
— Behavioral

SLA Policy Categories

Cost < 1€/month/LocationID. Hence eastbound will go directly to westbound provider SQS queue.
— Cost

SLA Policy Categories

IDT ⇐ 15 min and ODT > -100 && ODT < 150 and at least one IDT per floor.
— DataPoint Quality

Policy Category

No PII data exported from system.
— Compliance

CbReport & SLA Native

  • Understands CEOS

    • Reporting system [1]

    • Canonical data model [2]

  • Standard SLA entities

    • Latency, Availability, …​

1. ImportManifest, DroppedSensorsReport, MissingDataPoint report…​
2. Sensors, services and other energy related entities

Service Execution Knowledge

  • Which data to expect

  • Data stream and directions

  • Know when to expect events [1]

  • When the loop has closed (or not)

1. Such as a climate control signal

Example (Organization Level)

  • Global Policies on Product

    • No PII data import/export

  • Will be enforced by Provider & reported by Service Monitor

Not a SLA requirement per se, instead this is a plain policy!

Example (Product Level)

  • Company SLA Level 1

    • Availability 94.95%

Example (Remote Endpoint)

  • Standard SLA Parameters

    • Response time < 500ms

    • Availability > 95.5%

Example (Remote Endpoint)

  • Data Quality for Location: Måssmyren 18

    • At least one valid sensor per floor

    • IDT ⇐ 15 minute

    • ODT > -100 && ODT < 100

Example (Cb Service)

  • Crossbreed Smarter Building DH

    • Availability > 98.9%

    • Response time < 300ms

    • Control Signal ⇐ 15 min

    • Sensor Data ⇐ 15 min

      • IDT ⇐ 60 min

Example (Service Monitor)

  • Merges all Relevant Policies and SLA policies

    • Monitor and Reports per

      • LocationID

      • Service

      • Product