search

csepulveda / trivy-webhook-aws-security-hub

A webhook service to recibe trivy-operator hooks and publish the vulnerabilities to AWS Security Hub
GNU General Public License v3.0
0 stars 2 forks source link

IAM permissions #6

Closed akobir-arc closed 2 weeks ago

akobir-arc commented 3 weeks ago

hi @csepulveda thank you for starting this project, look forward to contributing where I can. I've hit the following error when using IRSA:

2024/10/23 21:48:08 Error importing findings to Security Hub: error importing findings to Security Hub: operation error SecurityHub: BatchImportFindings, https response error StatusCode: 403, RequestID: d4b23db7-db3d-4c8e-8026-b12149c7409b, api error AccessDeniedException: User: arn:aws:sts::<redacted>:assumed-role/trivy-operator-security-usw2/1729720088282019797 is not authorized to perform: securityhub:BatchImportFindings on resource: arn:aws:securityhub:us-west-2::product/aquasecurity/aquasecurity

For testing I've allowed the trivy-operator-security-usw2 role:

        {
            "Action": "securityhub:*",
            "Effect": "Allow",
            "Resource": "*"
        }

thoughts?

akobir-arc commented 2 weeks ago

missed this step:

aws securityhub enable-import-findings-for-product --product-arn arn:aws:securityhub:us-west-2::product/aquasecurity/aquasecurity