aws-security-hub-response-and-remediation
aws-security-hub-response-and-remediation copied to clipboard
Fixing KeyError details Lambdas CIS_2-9_RR & CIS_1-3_1-4_RR
Issue: When executing Lambdas for CIS 2.9, CIS 1.3 and CIS 1.4 you get "[ERROR] KeyError: 'Details'" due to params "nonRotatedKeyUser" and "noncompliantVPC" not being formatted in same way as the CloudWatch event.
For example, Event in Security Hub for CIS 1.4 looks like this:
"Resources": [
{
"Type": "AwsIamUser",
"Id": "arn:aws:iam::333333333333:user/user1",
"Partition": "aws",
"Region": "eu-west-1"
}
],
Lambda CIS_1-3_1-4_RR that is responsing to this event is catching nonRotatedKeyUser = str(event['detail']['findings'][0]['Resources'][0]['Details']['Other']['userName']) and error [ERROR] KeyError: 'Details' persist.
Suggested changes with included rsplit makes this format correct.