Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix value from filter in sg cidr check #4068

Merged

Conversation

lamyanba
Copy link
Contributor

@lamyanba lamyanba commented May 27, 2019

security-group filter for vpc resource is erroring out when used in config mode with ValueFrom attribute. The ValueFilter call from vpc resource is missing the manager object for the resource and causing the ValueFilter to error when looking up manager attributes.

example policy:

   resource: security-group
   mode:
      type: config-rule
      role: *******


   filters:
     - type: ingress
       Cidr:
         op: not-in
         value_from:
           url: s3://my_cidr_list.csv
           format: csv2dict ```

Error:
``` [ERROR] AttributeError: 'NoneType' object has no attribute 'config'
Traceback (most recent call last):
  File "/var/task/custodian_policy.py", line 4, in run
    return handler.dispatch_event(event, context)
  File "/var/task/c7n/handler.py", line 106, in dispatch_event
    p.push(event, context)
  File "/var/task/c7n/policy.py", line 905, in push
    return mode.run(event, lambda_ctx)
  File "/var/task/c7n/policy.py", line 708, in run
    resources = super(ConfigRuleMode, self).run(event, lambda_context)
  File "/var/task/c7n/policy.py", line 449, in run
    resources, event)
  File "/var/task/c7n/manager.py", line 105, in filter_resources
    resources = f.process(resources, event)
  File "/var/task/c7n/resources/vpc.py", line 908, in process
    return super(SGPermission, self).process(resources, event)
  File "/var/task/c7n/filters/core.py", line 181, in process
    return list(filter(self, resources))
  File "/var/task/c7n/resources/vpc.py", line 1024, in __call__
    perm_matches['cidrs'] = self.process_cidrs(perm)
  File "/var/task/c7n/resources/vpc.py", line 953, in process_cidrs
    found_v4 = self._process_cidr('Cidr', 'CidrIp', 'IpRanges', perm)
  File "/var/task/c7n/resources/vpc.py", line 941, in _process_cidr
    found = vf(ip_range)
  File "/var/task/c7n/filters/core.py", line 438, in __call__
    matched = self.match(i)
  File "/var/task/c7n/filters/core.py", line 486, in match
    values = ValuesFrom(self.data['value_from'], self.manager)
  File "/var/task/c7n/resolver.py", line 116, in __init__
    'account_id': manager.config.account_id, ```

Copy link
Collaborator

@kapilt kapilt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, lgtm

@kapilt kapilt merged commit 4dd156d into cloud-custodian:master May 27, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants