Update Macie support - CORE-387 #459
Conversation
arsci
requested review from
zackproser,
pete0emerson,
ellisonc,
hongil0316 and
denis256
as code owners
arsci
changed the title
arsci
changed the title
| // Macie cannot be disabled with an active administrator account | ||
| adminAccount, err := svc.GetAdministratorAccount(&macie2.GetAdministratorAccountInput{}) | ||
| if err != nil { | ||
| if strings.Contains(err.Error(), "there isn't a delegated Macie administrator") { |
There was a problem hiding this comment.
Could we key off the error's numeric code instead of string matching? My fear is that AWS changes the value out from under us without us knowing and this starts to break.
There was a problem hiding this comment.
@zackproser I thought about using it, unfortunately it's just a generic ResourceNotFoundException (which is the same error that gets returned if Macie isn't enabled). I figured it might be better to key off of the specific message in this case, but I am definitely open to going the other way, I could see AWS potentially changing the error message breaking this.
There was a problem hiding this comment.
@arsci No problem - I was thinking this could be the case. Let's not obsess over it in that case! 👍
|
Nicely done! |
Description
Closes CORE-387
Updated ability to nuke Macie resources
Macie itself is simply enabled/disabled for each region, however each instance must be cleared of Member Account links and administrator account links.
Added support for the use of time filter, but does not support the use of configObj regex filtering
Additional testing was done manually with multiple AWS accounts to ensure the proper functionality of the member disassociation/deletion and administrator deletion.
TODOs
Read the Gruntwork contribution guidelines.
nuke_sandboxandnuke_phxdevopsjobs in.circleci/config.ymlhave been updated with appropriate exclusions (either directly in the job or via the.circleci/nuke_config.ymlfile) to prevent nuking IAM roles, groups, resources, etc that are important for the test accounts.Release Notes
Updated Macie nuke support