ADR: Download Strategy #821
Conversation
carltonsmith
added
ADR
documentation
raft review
jtwillis92
added
QASP Review
and removed
raft review
|
|
||
| We believe the use of time/IP address limited signed URLs is a reasonably secure approach to downloading files from S3. However, we also believe that it may cause issues with our ATO approval as the data is highly sensitive. Furthermore, 18F published a recommendation today, [recommending to not use pre-signed URLs](https://engineering.18f.gov/security/cloud-services/) for FISMA High projects. | ||
|
|
||
| In our investigation we discovered a way that we can securely download the files from the backend while streaming the files directly from S3 to the client, taking any pressure off of resources needed for parsing files on the backend. |
There was a problem hiding this comment.
@carltonsmith sounds promising! can we include reference links here to what was found?
There was a problem hiding this comment.
The feature isn't documented in the docs, but can be found in the codebase, which is where we found it. I can include a link but it takes a bit of analysis to understand what is happening.
There was a problem hiding this comment.
@carltonsmith, yes it'd be great to have the link but also, i think it'd be really helpful to have a walk-through of part of the codebase where this is happening. let us know when you think it might be best to do this (if not today); or happy to have your suggestions on other ways we can go about learning about this alternative as part of qasp review 😃
There was a problem hiding this comment.
Updated this PR with technical documentation to explain how the downloads will work under this strategy.
Pasting the associated flowchart here for reference:
Co-authored-by: Lauren Frohlich <61251539+lfrohlich@users.noreply.github.com>
just a small update to the language
There was a problem hiding this comment.
thanks for the additional documentation @jtwillis92! helpful to have these breadcrumbs on how the dev team envisions this strategy being implemented.
cc: @lfrohlich
Summary of Changes
Documentation for our Download Strategy decision