Skip to content

v1.6.4 — AWS Labs CDEF bootstrap + admin refresh button

Choose a tag to compare

View all tags
@clem-field clem-field released this 18 May 21:36
v1.6.4
894e7a7

v1.6.4 — AWS Labs CDEF bootstrap + admin refresh button + security patches

Patch release bundling a Dependabot security fix, a routine patch, and the operator-facing half of the AWS Labs CDEF runtime ingestion feature shipped in v1.6.0 (#466).

🔒 Security

  • #485 — faraday 2.14.1 → 2.14.2. Dependabot-flagged security update; upstream advisory pending publication.

🐛 Patch

  • #486 — thruster 0.1.20 → 0.1.21. Routine patch; Go 1.26.3 base.

✨ Features

  • #487 — AWS Labs CDEF bootstrap-on-first-deploy. A new config/initializers/aws_labs_cdef_bootstrap.rb enqueues AwsLabsCdefRefreshJob.perform_later on the first boot where SPARC_AWS_LABS_CDEF_ENABLED=true and no AWS-Labs-sourced rows exist. Subsequent boots are no-ops. Tenants no longer have to wait for the weekly recurring tick to see their CDEF catalog populated.

    • Skips test env, rake/console contexts, and respects SPARC_SKIP_AWS_LABS_BOOTSTRAP=true as an escape hatch.
    • Guards against pre-migration boots (table_exists? check) and transient DB-not-reachable failures.
    • Clones (source_type=user_upload with cloned_from_id set) are excluded from the populated check via the aws_labs_sourced scope — a tenant with only clones still triggers bootstrap.

  • #488 — Admin "Refresh from AWS Labs" button on the CDEF index. Manual trigger for operators who want fresh CDEFs without waiting for the recurring job tick.

    • RBAC: gated on the same converters.write permission as the DISA CCI "Refresh Now" button.
    • Feature-flag gated: button + modal are hidden entirely when SPARC_AWS_LABS_CDEF_ENABLED=false (no tease-and-error).
    • In-flight cache lock (aws_labs_cdef_refresh:in_flight, 5-min TTL) prevents rapid double-click flooding.
    • Audit log entry: aws_labs_cdef_refresh_requested with triggered_via=ui and the actor's email.
    • Route: POST /cdef_documents/refresh_aws_labs (collection).

Testing

  • 10 new examples; full suite 2214 examples / 0 failures.
  • New spec files: spec/initializers/aws_labs_cdef_bootstrap_spec.rb, additions to spec/requests/cdef_documents_spec.rb.

Upgrade Notes

No migrations. No config changes required. To enable AWS Labs CDEF ingestion, set SPARC_AWS_LABS_CDEF_ENABLED=true — the bootstrap initializer will populate the catalog on the next deploy automatically.

Full Changelog: v1.6.3...v1.6.4

Assets 2
Loading