search

awslabs / aws-securityhub-multiaccount-scripts

This script automates the process of running the Security Hub multi-account workflow across a group of accounts that are in your control
MIT No Attribution
271 stars 108 forks source link

Bug: Misconfiguration of arn at `utils.get_standard_arn_for_region_and_resource` #43

Open o2346 opened 4 years ago

o2346 commented 4 years ago

Issue #, if available: N/A

Description of changes:

Following error occurs when trying to enable 'pci-dss'

Enabling the following Security Hub Standards for enabled account(s) and region(s): ['arn:aws:securityhub:::stardards/pci-dss/v/3.2.1']
Assumed session for 111111111111.
Won't try to link master account 111111111111 to itself
Assumed session for 111111111111.
Beginning 111111111111 in ap-northeast-1
Error Processing Account 111111111111
---------------------------------------------------------------
Failed Accounts
---------------------------------------------------------------
111111111111:
        InvalidInputException('An error occurred (InvalidInputException) when calling the BatchEnableStandards operation: Invalid StandardsSubscriptionRequest(s): [{"StandardsArn":"arn:aws:securityhub:ap-northeast-1::arn:aws:securityhub:::stardards/pci-dss/v/3.2.1"}]',)
---------------------------------------------------------------

I guess that's because given arn/ENABLE_STANDARDS is not parsed properly. When calling the function it passes arn.

Therefore I fixed else context of the function in order to ensure proper arn format for non-CIS stardards. Confirmed working properly with ENABLE_STANDARDSs shown below

ENABLE_STANDARDS worked?
--enable_standards arn:aws:securityhub:::standards/pci-dss/v/3.2.1 yes
--enable_standards arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0,arn:aws:securityhub:::standards/pci-dss/v/3.2.1 yes

Thanks

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.