手把手教你体验 Amazon Security Hub 的最佳实践

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents",
                "logs:DescribeLogGroups",
                "cloudtrail:UpdateTrail",
                "iam:GetRole"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::012345678910:role/<CloudTrail_CloudWatchLogs_Role>"
        }
    ]
}     

import json, boto3
        cloudtrail_client = boto3.client('cloudtrail')
        cloudwatchlogs_client = boto3.client('logs')
        iam_client = boto3.client('iam')
        
        role_details = iam_client.get_role(RoleName='<CloudTrail_CloudWatchLogs_Role>')
        
        def lambda_handler(event, context):
            # First off all, let us see if the JSON sent by CWE has any Security Hub findings.
            if 'detail' in event.keys() and 'findings' in event['detail'].keys() and len(event['detail']['findings']) > 0:
                print("There are some findings. Let's check them!")
                print("Number of findings: %i" % len(event['detail']['findings']))
        
                # Then we need to filter out the findings. In this code snippet, we'll handle only findings related to CloudTrail trails for integration with CloudWatch Logs.
                for finding in event['detail']['findings']:
                    if 'Title' in finding.keys():
                        if 'Ensure CloudTrail trails are integrated with CloudWatch Logs' in finding['Title']:
                            print("There's a CloudTrail-related finding. I can handle it!")
        
                            if 'Compliance' in finding.keys() and 'Status' in finding['Compliance'].keys():
                                print("Compliance Status: %s" % finding['Compliance']['Status'])
        
                                # We can skip compliant findings, and evaluate only the non-compliant ones.                        
                                if finding['Compliance']['Status'] == 'PASSED':
                                    continue
        
                                # For each non-compliant finding, we need to get specific pieces of information so as to create the correct log group and update the CloudTrail trail.                        
                                for resource in finding['Resources']:
                                    resource_id = resource['Id']
                                    cloudtrail_name = resource['Details']['Other']['name']
                                    loggroup_name = 'CloudTrail/' + cloudtrail_name
                                    print("ResourceId for the finding is %s" % resource_id)
                                    print("LogGroup name: %s" % loggroup_name)
        
                                    # At this point, we can create the log group using the name extracted from the finding.
                                    try:
                                        response_logs = cloudwatchlogs_client.create_log_group(logGroupName=loggroup_name)
                                    except Exception as e:
                                        print("Exception: %s" % str(e))
        
                                    # For updating the CloudTrail trail, we need to have the ARN of the log group. Let's retrieve it now.                            
                                    response_logsARN = cloudwatchlogs_client.describe_log_groups(logGroupNamePrefix = loggroup_name)
                                    print("LogGroup ARN: %s" % response_logsARN['logGroups'][0]['arn'])
                                    print("The role used by CloudTrail is: %s" % role_details['Role']['Arn'])
        
                                    # Finally, let's update the CloudTrail trail so that it sends logs to the new log group created.
                                    try:
                                        response_cloudtrail = cloudtrail_client.update_trail(
                                            Name=cloudtrail_name,
                                            CloudWatchLogsLogGroupArn = response_logsARN['logGroups'][0]['arn'],
                                            CloudWatchLogsRoleArn = role_details['Role']['Arn']
                                        )
                                    except Exception as e:
                                        print("Exception: %s" % str(e))
                        else:
                            print("Title: %s" % finding['Title'])
                            print("This type of finding cannot be handled by this function. Skipping it…")
                    else:
                        print("This finding doesn't have a title and so cannot be handled by this function. Skipping it…")
            else:
                print("There are no findings to remediate.")