Skip to content
This repository was archived by the owner on May 13, 2024. It is now read-only.

Conversation

@pozeus
Copy link

@pozeus pozeus commented Aug 4, 2020

Issue:
When executing Lambdas for CIS 2.9, CIS 1.3 and CIS 1.4 you get "[ERROR] KeyError: 'Details'" due to params "nonRotatedKeyUser" and "noncompliantVPC" not being formatted in same way as the CloudWatch event.

For example, Event in Security Hub for CIS 1.4 looks like this:

"Resources": [
    {
      "Type": "AwsIamUser",
      "Id": "arn:aws:iam::333333333333:user/user1",
      "Partition": "aws",
      "Region": "eu-west-1"
    }
  ],

Lambda CIS_1-3_1-4_RR that is responsing to this event is catching nonRotatedKeyUser = str(event['detail']['findings'][0]['Resources'][0]['Details']['Other']['userName']) and error [ERROR] KeyError: 'Details' persist.
Suggested changes with included rsplit makes this format correct.

When executing Lambdas for CIS 2.9, CIS 1.3 and CIS 1.4 you get "[ERROR] KeyError: 'Details'" due to params "nonRotatedKeyUser" and "noncompliantVPC" not being formatted in same way as the CloudWatch event.
Combination of above solves this issue.
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant