Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Rename references to old github organisation #336

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Rename references to old github organisation #336

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .devcontainer/devcontainer.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@
"ghcr.io/devcontainers/features/azure-cli:1.0.8": {
"version": "2.47.0",
"extensions": "ml"
// extensions do not currently install, investigating in separate issue: https://github.com/UCLH-Foundry/FlowEHR/issues/286
// extensions do not currently install, investigating in separate issue: https://github.com/SAFEHR-data/FlowEHR/issues/286
},
"ghcr.io/devcontainers/features/node:1": {},
"ghcr.io/devcontainers/features/github-cli:1": {
Expand Down
26 changes: 13 additions & 13 deletions CIS-Adherence.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,9 +36,9 @@ This layer deploys the core components required for other layers, including a nu
| Azure Resource | CIS Reference | Adherence | Notes |
|--|--|--|--|
| Core Virtual Network: <br/>`vnet-<suffix>` | `CIS 6` | [network.tf](./infrastructure/core/network.tf) | Allows other resources to remain non-internet-accessible |
| | `CIS 5.1.6`: Ensure NSG Flow Logs are captured and sent to Log Analytics | Y | https://github.com/UCLH-Foundry/FlowEHR/issues/187 |
| | `CIS 6.6`: Ensure 'Network Watcher' is enabled for all networks | Y | https://github.com/UCLH-Foundry/FlowEHR/issues/187 |
| Azure Storage Account for FlowEHR management: <br/>`strg<suffix>` | `CIS 3` | [main.tf](./infrastructure/core/main.tf) | Issues summarised https://github.com/UCLH-Foundry/FlowEHR/issues/176 |
| | `CIS 5.1.6`: Ensure NSG Flow Logs are captured and sent to Log Analytics | Y | https://github.com/SAFEHR-data/FlowEHR/issues/187 |
| | `CIS 6.6`: Ensure 'Network Watcher' is enabled for all networks | Y | https://github.com/SAFEHR-data/FlowEHR/issues/187 |
| Azure Storage Account for FlowEHR management: <br/>`strg<suffix>` | `CIS 3` | [main.tf](./infrastructure/core/main.tf) | Issues summarised https://github.com/SAFEHR-data/FlowEHR/issues/176 |
| | `CIS 3.1`: Ensure 'Secure Transfer Required' set to 'Enabled' | Y | |
| | `CIS 3.2`: Ensure 'Enable Infrastructure Encryption' set to 'Enabled' | Y | |
| | `CIS 3.3`: Enable key rotation reminders for each storage account | N | Storage keys are not used for authentication |
Expand All @@ -55,16 +55,16 @@ This layer deploys the core components required for other layers, including a nu
| | `CIS 8.5`: Ensure the key vault is recoverable | Y | Purge protection enabled for prod environments |
| | `CIS 8.6`: Ensure RBAC enabled for Azure Key Vault | Y | |
| | `CIS 8.7`: Ensure Private Endpoints are used for Azure Key Vault | Y | Public internet access disabled, PE into VNET |
| | `CIS 10.1`: Ensure that resource locks are set for critical resources | TODO | https://github.com/UCLH-Foundry/FlowEHR/issues/124 |
| Microsoft Defender for Cloud | `CIS 2.1` | N | TODO: Enable MS Defender for Cloud for the Prod subscription: https://github.com/UCLH-Foundry/FlowEHR/issues/174 . This is an 'org' level feature, and should be applied and managed at a subscription / management group level, by Subscription Owners. |
| | `CIS 10.1`: Ensure that resource locks are set for critical resources | TODO | https://github.com/SAFEHR-data/FlowEHR/issues/124 |
| Microsoft Defender for Cloud | `CIS 2.1` | N | TODO: Enable MS Defender for Cloud for the Prod subscription: https://github.com/SAFEHR-data/FlowEHR/issues/174 . This is an 'org' level feature, and should be applied and managed at a subscription / management group level, by Subscription Owners. |
| | `CIS 2.1.2`: Ensure Microsoft Defender for App Services is set to 'On' | n/a | Set at org level |
| | `CIS 2.1.4`: Ensure Microsoft Defender for Azure SQL Databases is set to 'On' | n/a | Set at org level |
| | `CIS 2.1.5`: Ensure Microsoft Defender for Azure SQL Servers is set to 'On' | n/a | Set at org level |
| | `CIS 2.1.7`: Ensure Microsoft Defender for Storage is set to 'On' | n/a | Set at org level |
| | `CIS 2.1.8`: Ensure Microsoft Defender for Containers is set to 'On' | n/a | Set at org level |
| | `CIS 2.1.9`: Ensure Microsoft Defender for Azure Cosmos DB is set to 'On' | n/a | Set at org level |
| | `CIS 2.1.10`: Ensure Microsoft Defender for Key Vault is set to 'On' | n/a | Set at org level |
| Azure Log Analytics: <br/>`log-<suffix>` | `CIS 5` | TODO | https://github.com/UCLH-Foundry/FlowEHR/issues/187 |
| Azure Log Analytics: <br/>`log-<suffix>` | `CIS 5` | TODO | https://github.com/SAFEHR-data/FlowEHR/issues/187 |
| | `CIS 5.1.1`: Ensure Diagnostic setting exists (per resource) | TODO | |
| | `CIS 5.1.2`: Ensure Diagnostic setting captures appropriate categories | TODO | |
| | `CIS 5.1.4`: Ensure Diagnostic log storage container is encrypted with Customer Managed Key | N | System managed keys chosen to reduce management burden |
Expand All @@ -78,19 +78,19 @@ This layer deploys components required to ingest data, transform data, and save
| Azure Resource | CIS Reference | Adherence | Notes |
|--|--|--|--|
| Azure SQL Server:<br/> `sql-server-features-suffix` | [feature-data-store.tf](./infrastructure/core/feature-data-store.tf) | |
| | `CIS 4.1.1`: Ensure auditing is set to 'on' | Y | https://github.com/UCLH-Foundry/FlowEHR/issues/172 |
| | `CIS 4.1.1`: Ensure auditing is set to 'on' | Y | https://github.com/SAFEHR-data/FlowEHR/issues/172 |
| | `CIS 4.1.2`: Ensure no SQL databases allow ingress from 0.0.0.0/0 (any IP) | Y | All public access disabled |
| | `CIS 4.1.3`: Ensure SQL uses Transparent Data Encryption with customer managed key | N | Decision was made to use Service Managed Key to decrease management overhead |
| | `CIS 4.1.4`: Ensure AAD admin is configured | Y | Owner is an auto-created Service Principal account, with credentials saved in key vault |
| | `CIS 4.1.5`: Ensure 'Data encryption' is set to 'on' | Y | Service Managed Key |
| | `CIS 4.1.6`: Ensure that 'Auditing Retention' is set to 'Greater than 90 days' | Y | https://github.com/UCLH-Foundry/FlowEHR/issues/172 |
| | `CIS 4.2.1`: Ensure Microsoft Defender for SQL is set to 'on' | TODO | https://github.com/UCLH-Foundry/FlowEHR/issues/174 |
| | `CIS 4.1.6`: Ensure that 'Auditing Retention' is set to 'Greater than 90 days' | Y | https://github.com/SAFEHR-data/FlowEHR/issues/172 |
| | `CIS 4.2.1`: Ensure Microsoft Defender for SQL is set to 'on' | TODO | https://github.com/SAFEHR-data/FlowEHR/issues/174 |
| | `CIS 4.2.2 -> CIS 4.2.5`: Ensure Vulnerability Assessment is enabled by setting a storage account | Y | |
| | `CIS 10.1`: Ensure that resource locks are set for critical resources | TODO | https://github.com/UCLH-Foundry/FlowEHR/issues/124 |
| | `CIS 10.1`: Ensure that resource locks are set for critical resources | TODO | https://github.com/SAFEHR-data/FlowEHR/issues/124 |
| Azure Key Vault Secrets | | [secrets.tf](./infrastructure/transform/secrets.tf) |
| | `CIS 8.3`: Ensure expiration is set for all secrets in RBAC vaults | N | No automated secret rotation in place as of yet. Will be taken care of as a manual background task. |
| Azure Databricks | Databricks is not referenced in the CIS benchmark | | Below are some relevant security settings |
| | Network Isolation | Partial | - Databricks nodes are network isolated <br/>- Databricks control plane is internet accessible. This can and should be switched off when internal routing is in place: https://github.com/UCLH-Foundry/FlowEHR/issues/201 |
| | Network Isolation | Partial | - Databricks nodes are network isolated <br/>- Databricks control plane is internet accessible. This can and should be switched off when internal routing is in place: https://github.com/SAFEHR-data/FlowEHR/issues/201 |
| | Secret management | Y | Secrets are stored in Databricks private secret scopes. Due to API limitation, it was not possible to use Key Vault backed vaults |
| Azure Key Vault for Apps: <br/>`kv-<suffix>-serve` | `CIS 8` | [keyvault.tf](./infrastructure/serve/keyvault.tf) | |
| | `CIS 8.5`: Ensure the key vault is recoverable | Y | Purge protection enabled for prod environments |
Expand Down Expand Up @@ -119,7 +119,7 @@ This layer deploys components required to ingest data, transform data, and save
| | `CIS 9.2`: Ensure all HTTP traffic is redirected to HTTPS | Y | |
| | `CIS 9.3`: Ensure web apps are using latest version of TLS | Y | |
| | `CIS 9.4`: Ensure web apps have 'Incoming Client Certificates' set to 'On' | N | Choice made not to use client cert auth due to a number of overheads |
| | `CIS 6.4`: Ensure HTTPS access from the internet is evaluated and restricted | TODO | https://github.com/UCLH-Foundry/FlowEHR/issues/109 |
| | `CIS 6.4`: Ensure HTTPS access from the internet is evaluated and restricted | TODO | https://github.com/SAFEHR-data/FlowEHR/issues/109 |
| | `CIS 9.5`: Ensure that 'Registed with AAD' is 'On' | Y | MSI used for container registry |
| | `CIS 9.10`: Ensure that FTP is disabled | Y | |
| | `CIS 9.11`: Ensure Key Vaults are used to store secrets | Y | |
Expand All @@ -129,7 +129,7 @@ This layer deploys components required to ingest data, transform data, and save
| | `CIS 4.5.3`: Ensure AAD Client Auth & RBAC are used where possible | Y | |
| App Insights: <br/>`ai-<suffix>` | | | |
| | `CIS 5.3.1`: Ensure App Insights are configured | Y | |
| Background Storage Account for AML Registry | `CIS 3` | | [aml.tf](./infrastructure/serve/aml.tf). [Issue to track here](https://github.com/UCLH-Foundry/FlowEHR/issues/285) |
| Background Storage Account for AML Registry | `CIS 3` | | [aml.tf](./infrastructure/serve/aml.tf). [Issue to track here](https://github.com/SAFEHR-data/FlowEHR/issues/285) |
| | `CIS 3.1`: Ensure 'Secure Transfer Required' set to 'Enabled' | Y | |
| | `CIS 3.2`: Ensure 'Enable Infrastructure Encryption' set to 'Enabled' | Y | |
| | `CIS 3.3`: Enable key rotation reminders for each storage account | N | Storage keys are not used for authentication |
Expand Down
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,7 +137,7 @@ This step will create an AAD Application and Service Principal in the specified

For CI deployments, due to certain resources being deployed within a Virtual Network with public access disabled, we need to use private build agents (also called self-hosted GitHub runners) to run our CI pipelines. We also need somewhere to store the associated container images and Terraform state within a vnet.

You can use [the Azure Bootstrap template](https://github.com/UCLH-Foundry/Azure-Bootstrap) to deploy all these resources, or alternatively, you can reference pre-existing resources in the following steps.
You can use [the Azure Bootstrap template](https://github.com/SAFEHR-data/Azure-Bootstrap) to deploy all these resources, or alternatively, you can reference pre-existing resources in the following steps.

5. Create a deployer identity (AAD App Registration/Service Principal) with required AAD permissions:

Expand Down Expand Up @@ -181,7 +181,7 @@ This step will create an AAD Application and Service Principal in the specified

### Next steps

- [Deploy a data transformation pipeline](https://github.com/UCLH-Foundry/FlowEHR-Data-Pot/blob/main/README.md)
- [Deploy a data transformation pipeline](https://github.com/SAFEHR-data/FlowEHR-Data-Pot/blob/main/README.md)
- [Configure and deploy a FlowEHR app](./apps/README.md)


Expand Down
2 changes: 1 addition & 1 deletion apps/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ Once created, you need to the install the app to the organization. [Follow these
After installation, stay on the same page and check the URL. It should look like this:

```
https://github.com/organizations/UCLH-Foundry/settings/installations/123456789
https://github.com/organizations/SAFEHR-data/settings/installations/123456789
```

At the end of the URL after `installations/`, you'll see a number. Record this down - it is your `GitHub App Installation Id`. (Believe it or not this is the easiest way to find it!)
Expand Down
2 changes: 1 addition & 1 deletion apps/apps.infra-test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,6 @@ flowehr_cicd_test:
add_testing_slot: false
managed_repo:
private: false
template: UCLH-Foundry/Dash-Seedling
template: SAFEHR-data/Dash-Seedling
auth:
easy_auth: true
2 changes: 1 addition & 1 deletion apps/apps.sample.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ dash_seedling: # unique ID for the app
octokitten: an_aad_user@mycompany.com
managed_repo: # details for repo to create/manage
private: false # repo visibility
template: UCLH-Foundry/Dash-Seedling # template to use in format GH_ORG/TEMPLATE_NAME
template: SAFEHR-data/Dash-Seedling # template to use in format GH_ORG/TEMPLATE_NAME
branch: # details of the branch created with a name: <environment>
num_of_approvals: 1
env: # any env vars to pass to the app container
Expand Down
2 changes: 1 addition & 1 deletion config.infra-test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ private_dns_zones_rg: rg-bootstrap-uclh-ci-dev
transform:
spark_version: 3.4
repositories:
- url: https://github.com/UCLH-Foundry/FlowEHR-Data-Pot
- url: https://github.com/SAFEHR-data/FlowEHR-Data-Pot
datalake:
zones:
- Bronze
Expand Down
2 changes: 1 addition & 1 deletion infrastructure/transform/feature-data-store.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@ resource "azurerm_mssql_server_transparent_data_encryption" "sql_server_features
}

# Azure SQL database, basic + small for dev
# TODO: Rightsize for prod -> https://github.com/UCLH-Foundry/FlowEHR/issues/63
# TODO: Rightsize for prod -> https://github.com/SAFEHR-data/FlowEHR/issues/63
resource "azurerm_mssql_database" "feature_database" {
name = "sql-db-features"
server_id = azurerm_mssql_server.sql_server_features.id
Expand Down
2 changes: 1 addition & 1 deletion shared.hcl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ inputs = merge(
}
})

# Databricks cluster deployment failures are transient. https://github.com/UCLH-Foundry/FlowEHR/issues/141
# Databricks cluster deployment failures are transient. https://github.com/SAFEHR-data/FlowEHR/issues/141
retryable_errors = [
"cannot create cluster", # databricks
"Waiting for deletion of application" # AD application
Expand Down
Loading