Class MessagingSecurityRules

java.lang.Object
com.cloudforgeci.api.core.rules.MessagingSecurityRules
All Implemented Interfaces:
FrameworkRules<SystemContext>
@ComplianceFramework(value="MessagingSecurity", priority=0, alwaysLoad=true, displayName="Messaging Security", description="Cross-framework messaging service security validation") public class MessagingSecurityRules extends Object implements FrameworkRules<SystemContext>
Messaging security compliance validation rules.

These rules enforce SQS, SNS, Secrets Manager, and messaging service security requirements across multiple compliance frameworks:

  • PCI-DSS - Req 3.4: Encryption; Req 8.2: Credential management
  • HIPAA - §164.312(a)(2)(iv): Encryption; §164.308(a)(5)(ii)(D): Password management
  • SOC 2 - CC6.1: Encryption and credential controls
  • GDPR - Art.32(1)(a): Encryption of data

Controls Implemented

  • SQS/SNS encryption at rest
  • Secrets Manager KMS encryption
  • Secrets rotation configuration
  • Dead letter queue configuration
  • Kinesis stream encryption
Since:
3.0.0

  • Constructor Details

    • MessagingSecurityRules

      public MessagingSecurityRules()

  • Method Details

    • install

      public void install(SystemContext ctx)
      Install messaging (SQS/SNS) security validation rules. An always-load, cross-framework class -- runs for every deployment regardless of which compliance frameworks are selected.
      Specified by:
      install in interface FrameworkRules<SystemContext>
      Parameters:
      ctx - System context

    • claimedControls

      public Set<String> claimedControls()
      Controls checked across every validate* method above -- see FrameworkRules.claimedControls(). MESSAGING-ENCRYPTION now reads config.isSnsKmsEncryptionEnabled() directly (previously used S3 bucket encryption "as a proxy", which never reflected the SNS topic's own encryption state). SECRETS-ROTATION calls the matrix with SECRETS_ROTATION, but the boolean passed in is a hardcoded true, so rotationResult can never be FAIL and the fail branch is dead regardless of the secretsRotationEnabled setting -- not claimed. Kinesis encryption, Secrets Manager KMS encryption, and DLQ configuration are conditional checks with no corresponding matrix control and are not claimed.
      Specified by:
      claimedControls in interface FrameworkRules<SystemContext>
      Returns:
      the control identifiers this framework's install() validates; empty if undeclared