Atlassian Forge Shared Responsibility Model
- Daniel Roller
General
When building an app with Atlassian Forge, developers have to comply with various guidelines and meet specific responsibilities that emerge from the https://developer.atlassian.com/platform/forge/shared-responsibility-model. The shared responsibility model for Atlassian Forge extends the more general https://developer.atlassian.com/developer-guide/cloud-shared-responsibility-model/.
On this page we will provide some extended information on how we comply with those responsibilities regarding Agile Hive for Jira Cloud.
Forge Shared Responsibility Model
As of Sep 26, 2023, the Shared Responsibility Model for Forge apps (available at https://developer.atlassian.com/platform/forge/shared-responsibility-model) includes the categories and responsibilities listed below.
Responsibility | Custom UI | UI kit | Web triggers |
|---|---|---|---|
App elements | |||
Atlassian | Atlassian | You | |
Atlassian & You | Atlassian & You | You | |
You | Atlassian & You | You | |
You | You | You | |
Atlassian & You | Atlassian | Atlassian | |
Atlassian & You | Atlassian & You | Atlassian & You | |
Atlassian & You | Atlassian & You | Atlassian & You | |
Atlassian | Atlassian | Atlassian | |
Operational elements | |||
Atlassian & You | Atlassian & You | Atlassian & You | |
Atlassian | Atlassian | Atlassian | |
Atlassian | Atlassian | Atlassian | |
Atlassian | Atlassian | Atlassian | |
Atlassian & You | Atlassian & You | Atlassian & You | |
Atlassian & You | Atlassian & You | Atlassian & You | |
Atlassian & You | Atlassian & You | Atlassian & You | |
Atlassian & You | Atlassian & You | Atlassian & You | |
Security features | |||
Atlassian | Atlassian | Atlassian | |
Atlassian | Atlassian | Atlassian | |
Atlassian & You | Atlassian & You | Atlassian & You | |
Addressing responsibilities in Agile Hive development
In the sections below we provide additional details on specific responsibilities from the Forge Shared Responsibility Model as of Sep 26, 2023.
Authorization of requests to the app
Atlassian documentation
Ensure that every request made to the application is sufficiently authorized.
Your responsibilities
You must use
asUser()whenever you are performing an operation on behalf of a user. This ensures your app has at most the permissions of the calling user.Before making calls
asApp(), you must verify expected permissions (for example, from product context) with the permissions REST APIs before making the request.
Atlassian's responsibilities
Obtain user consent for
asUser()calls before invoking your Forge application.Ensure that only users with access to the site can interact with apps.
How we address those responsibilities
The asUser option is used as the standard method to make requests. This ensures that we minimise risks regarding violations to permissions set in Jira. The asApp option is only used where absolutely necessary (some Jira API endpoints are only functional via asApp requests) and requires additional security review.
Data storage
Atlassian documentation
Ensure that data is appropriately stored and read by your app.
Your responsibilities
Ensure that sensitive security data, such as pre-shared keys, API keys, or encryption keys are not hardcoded in the source code. Secure storage, such as encrypted environment variables, should be used to supply keys at runtime.
Ensure that keys are rotated on a regular basis. You should rotate sensitive API keys at least every 90 days.
Ensure that authorisation controls exist to segregate data access between different user roles within the same tenant.
Atlassian's responsibilities
Encrypt data at rest for data stored within Forge app storage.
Segregate data storage to prevent cross-tenant access. This includes Forge app storage.
How we address those responsibilities
We currently do not store keys or secrets of any kind and do not store any data on external systems. Additionally, an automated scanner checks the code base for any potential keys or secrets.
Software development lifecycle (SDLC) activities
Atlassian documentation
Apply secure software development practices when building and maintaining your app.
Your responsibilities
Periodically scan for vulnerabilities in third-party dependencies using tools, such as OWASP Dependency-Check or other similar tools.
Perform regular threat modeling to identify and prioritize threats that may impact the security of your app.
Perform static analysis of your app to identify patterns of insecure code.
How we address those responsibilities
We use Dependency-Track and better-npm-audit to continually check our app for vulnerable components.
Threat modeling is part of the annual security analysis carried out by the designated security champions of our company.
During development, sonarlint is used for static code security analysis.
Logging
How we address those responsibilities
Logging is strictly limited to non-sensitive data and ensured by review.
Vulnerability management and disclosure
How we address those responsibilities
Security vulnerabilities are treated as highest priority tickets and released on fix. Notifications to Atlassian are part of the security incident response plan.
Security incident response
How we address those responsibilities
We have a security incidence response plan that matches the requirements outlined by Atlassian and is designed to be compliant with the ISO 27001 standard.
Link to this page: https://seibert.biz/ahc-forge-shared-responsibility-model