wazuh / wazuh-indexer

Wazuh indexer, the Wazuh search engine
https://opensearch.org/docs/latest/opensearch/index/
Apache License 2.0
11 stars 17 forks source link

Security Lake Integration should support cross-account #276

Open kclinden opened 3 months ago

kclinden commented 3 months ago

Is your feature request related to a problem? Please describe. The 4.9.0 security lake integration currently assumes that the lambda function is running from the same account as AWS Security Lake. This should be ran from a different account the Lambda role should assume the Security Lake created role with an external id.

Describe the solution you'd like Enhance the Security Lake integration to support cross account

Describe alternatives you've considered Run the lambda in the same account as security lake which is not recommended by the AWS Security Reference Architecture

Additional context Source - https://github.com/wazuh/wazuh-indexer/blob/4.9.0/integrations/amazon-security-lake/src/lambda_function.py#L50