Skip to content

Commit 20335dd

Browse files
authored
Wrap scp collection into try catch (#2241)
1 parent d3c8833 commit 20335dd

1 file changed

Lines changed: 25 additions & 17 deletions

File tree

  • plugins/aws/fix_plugin_aws/resource

plugins/aws/fix_plugin_aws/resource/scp.py

Lines changed: 25 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,12 @@
22
from typing import List, Optional
33
from json import loads as json_loads
44
from fixlib.types import Json
5-
5+
from logging import getLogger
66

77
_expected_errors = ["AccessDeniedException", "AWSOrganizationsNotInUseException"]
88

9+
logger = getLogger(__name__)
10+
911

1012
def get_scps(target_id: str, client: AwsClient) -> Optional[List[Json]]:
1113
policies: List[Json] = client.list(
@@ -113,21 +115,27 @@ def filter_allow_all(levels: List[List[Json]]) -> List[List[Json]]:
113115

114116
def collect_account_scps(account_id: str, scrape_org_role_arn: Optional[str], client: AwsClient) -> List[List[Json]]:
115117

116-
if scrape_org_role_arn:
117-
scp_client = AwsClient(
118-
client.config,
119-
client.account_id,
120-
role=scrape_org_role_arn,
121-
profile=client.profile,
122-
region=client.region,
123-
partition=client.partition,
124-
error_accumulator=client.error_accumulator,
125-
)
126-
else:
127-
scp_client = client
118+
try:
119+
120+
if scrape_org_role_arn:
121+
scp_client = AwsClient(
122+
client.config,
123+
client.account_id,
124+
role=scrape_org_role_arn,
125+
profile=client.profile,
126+
region=client.region,
127+
partition=client.partition,
128+
error_accumulator=client.error_accumulator,
129+
)
130+
else:
131+
scp_client = client
132+
133+
account_scps = find_account_scps(scp_client, account_id)
134+
account_scps = filter_allow_all(account_scps)
135+
account_scps = [level for level in account_scps if level]
128136

129-
account_scps = find_account_scps(scp_client, account_id)
130-
account_scps = filter_allow_all(account_scps)
131-
account_scps = [level for level in account_scps if level]
137+
return account_scps
132138

133-
return account_scps
139+
except Exception as e:
140+
logger.info(f"Error collecting SCPs for account {account_id}", exc_info=e)
141+
return []

0 commit comments

Comments
 (0)