Help with component content

[bjcbusiness]

I feel like i must be doing something wrong or understanding the system capabilities incorrectly. I'm new here so please bear with me as I learn.

I've got a set of controls (800-53); I've also got a component that implements some of it (AWS from CivicActions). The former has statements within controls, and the latter selects some of those statements and adds prose about how they're implemented.

My expectation is that when I trestle author component-generate for AWS, the resulting MD files should have all the details from the AWS component in each MD file. Instead, the MD files only contain the control information from the NIST catalog.

Example:
AWS has in AC-2 section the following,

            "implemented-requirements": [
              {
                "uuid": "c9cbefe4-5c62-4a14-bbb6-91cb5658dfc8",
                "control-id": "ac-2",
                "description": "The system partially inherits this control from the FedRAMP Provisional ATO granted to the AWS Cloud dated 1 May 2013 for the following: AWS account management.",
                "statements": [
                  {
                    "statement-id": "ac-2_smt.a",
                    "uuid": "e0f7efea-4cba-4df2-93e7-c9b7a0f4ac6d",
                    "description": "In this architecture, the baseline AWS Identity and Access Management (IAM) groups and roles are associated with access policies to align user accounts with personnel functions related to infrastructure/platform management (e.g. Billing, Amazon EC2/VPC/Amazon RDS systems administration, I.T. auditing, etc.)"
                  },
                  {
                    "statement-id": "ac-2_smt.g",
                    "uuid": "cbc8f16c-1e23-4ca2-b344-4ea55aacd5f5",
                    "description": "In this architecture, AWS CloudTrail and Amazon S3 Bucket logging are enabled, which provide the audit trail capability for the organization to monitor the use of AWS Identity and Access Management (IAM) accounts. An Amazon S3 bucket centrally contains the CloudTrail audit logs. Amazon CloudWatch Alarm is configured to send an alert when any of the following happen:\n  - an API call is made to create, update, or delete a Network ACL/Security Group\n  - AWS account *root user* activity is detected\n  - multiple API actions or login attempts fail\n  - IAM Configuration changes are detected\n  - new IAM access key was created\n  - changes to the CloudTrail log configuration are detected"
                  }
                ]
              },

But none of the information about CloudTrail shows up in the generated MD files

Furthermore, when I change anything in the MD file--like implementation status--and perform trestle author component-assemble then the changes are not saved into the .json.

Should it be working like I expected? If not, what should I expect instead?

[jpower432]

Hi @bjcbusiness. Thanks for submitting this discussion. I found the component definition and want to document my reproduction steps here. I experienced the same issues you are reporting.

trestle init
trestle import -f https://raw.githubusercontent.com/CivicActions/oscal-component-definitions/main/aws/oscal/aws.json -o aws
trestle author component-generate -o md_comp/aws --name aws
trestle author component-assemble --markdown md_comp/aws/ -o aws

The trestle authoring processes for component definitions begins with adding a Rule (this is a trestle construct). There is additional information here in the website tutorial.

I experimented here and added a test Rule to the existing component definition and found that it worked as expected when generated and assembled.

            "implemented-requirements": [
              {
                "uuid": "c9cbefe4-5c62-4a14-bbb6-91cb5658dfc8",
                "control-id": "ac-2",
                "description": "The system partially inherits this control from the FedRAMP Provisional ATO granted to the AWS Cloud dated 1 May 2013 for the following: AWS account management and other things.",
                "props": [
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd",
                    "value": "Test-rule_001"
                  },
                  {
                    "name": "implementation-status",
                    "value": "implemented"
                  }
                ]
              }

Based on this, I think at least a bug report will need to be submitted to ensure this unexpected behavior does not occur.

I also wanted to link this issue that may be applicable. If I understand correctly, you are trying to take a Component Definition not authored through trestle and instantiate a trestle authoring workspace to further refine the content. Is that correct?

@vikas-agarwal76 @AleJo2995 @degenaro Is there anything you can add here or is there something I have missed? Perhaps extending the new include-all-parts functionality in SSPs to component definitions could be a solution?

[degenaro]

Thanks for raising the issue and for the investigative work. I am not well versed in the markdown support aspect, so I would defer to @vikas-agarwal76 + @AleJo2995 + @butler54 on the whether this is working as designed or a bug. If the former, it seems that an include-all-parts solution is a possibility.

[bjcbusiness]

Hi folks Thank you for looking at this! I am currently completely away from my work email and system and will not be able to provide any substantial reply until late August. I’m very interested to use the trestle system so rest assured I’ll reply to these queries when I return Regards Ben

…

________________________________ From: Lou DeGenaro ***@***.***> Sent: Wednesday, July 24, 2024 1:39:30 PM To: oscal-compass/compliance-trestle ***@***.***> Cc: Collar, Ben (DI SW PLM LCS CF) ***@***.***>; Mention ***@***.***> Subject: Re: [oscal-compass/compliance-trestle] Help with component content (Discussion #1631) Thanks for raising the issue and for the investigative work. I am not well versed in the markdown support aspect, so I would defer to @vikas-agarwal76<https://github.com/vikas-agarwal76> + @AleJo2995<https://github.com/AleJo2995> + @butler54<https://github.com/butler54> on the whether this is working as designed or a bug. If the former, it seems that an include-all-parts solution is a possibility. — Reply to this email directly, view it on GitHub<#1631 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BHHDEZ3XAG7PDW2WLDHNOILZN7RFFAVCNFSM6AAAAABLAXNIW2VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTAMJUGA4DONQ>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[jpower432]

Hi @bjcbusiness. Just wanted to link an initial bug report I submitted based on the reproduction steps above #1667. Happy to further discuss here or on the issue after your return.