Skip to content
This repository was archived by the owner on May 13, 2024. It is now read-only.

Conversation

pozeus
Copy link

@pozeus pozeus commented Aug 4, 2020

Issue:
When executing Lambdas for CIS 2.9, CIS 1.3 and CIS 1.4 you get "[ERROR] KeyError: 'Details'" due to params "nonRotatedKeyUser" and "noncompliantVPC" not being formatted in same way as the CloudWatch event.

For example, Event in Security Hub for CIS 1.4 looks like this:

"Resources": [
    {
      "Type": "AwsIamUser",
      "Id": "arn:aws:iam::333333333333:user/user1",
      "Partition": "aws",
      "Region": "eu-west-1"
    }
  ],

Lambda CIS_1-3_1-4_RR that is responsing to this event is catching nonRotatedKeyUser = str(event['detail']['findings'][0]['Resources'][0]['Details']['Other']['userName']) and error [ERROR] KeyError: 'Details' persist.
Suggested changes with included rsplit makes this format correct.

When executing Lambdas for CIS 2.9, CIS 1.3 and CIS 1.4 you get "[ERROR] KeyError: 'Details'" due to params "nonRotatedKeyUser" and "noncompliantVPC" not being formatted in same way as the CloudWatch event.
Combination of above solves this issue.
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant