Check on legality of publishing AWS control information

[afeld]

AWS compliance documentation is (in some cases?) protected under NDA. The content in the Control files in this repository may be in violation of that already.

While I have not dug into them myself, the AWS compliance packages likely dive into a lot of detail that is not directly needed by OpenControl users. The main use case of having a canonical set of AWS OpenControl Components is knowing what controls are fully inheritable, versus which have shared or full customer responsibility. Therefore, I would argue that it's not important that the control narrative includes any details about the implementation - it can simply say "Refer to the AWS FedRAMP package for details." Even so, I'm not sure if the list of controls implemented by AWS is considered proprietary information or not, or if they would be willing to release it in a non-restrictive way so they could be leveraged here.

Anyone have a contact at AWS to ask?

[rafael5]

Great idea. I have several contacts in AWS Federal and will ask about availability and publication in public, machine processable form.

[rafael5]

I just checked the AWS Artifact repository - there are 2500 artifacts regarding all their certifications and controls - and all require an NDA - so we cannot publish.

Nevertheless, I will ask AWS if a subset of their artifacts pertaining to ATO for FedRAMP-high controls can be published machine processable form..

[afeld]

We can't publish based on those. Perhaps AWS would be willing to work with us to publish just the controls publicly, if we present them with why.

In the meantime, could provide a script to create the YAML files based on source packages that users would have to run on their own.

[rafael5]

Agree. So what is the most compelling framing of our 'ask'? To speed ATO in their Cloud? What is the best demonstration we can provide? What government agencies are already using opencontrol schemas? We need #'s and data to convince AWs.

[afeld]

what is the most compelling framing of our 'ask'? To speed ATO in their Cloud?

Exactly.

What is the best demonstration we can provide?

There's a demo video from a couple years ago - shows the basics in the first ten minutes.

What government agencies are already using opencontrol schemas?

See opencontrol/discuss#33.