Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Add account ID to GuardDuty event notification #187

Merged
merged 4 commits into from
Jan 26, 2023

Conversation

bruno
Copy link
Contributor

@bruno bruno commented Jan 23, 2023

Description

Always show the AWS AccountID that the GuardDuty event is related to.

I've modified the sample events and messages to add a bogus accountId. Running the pipenv commands as per the README made some formatting changes on mylambda.py, so I am leaving that as suggested by that run.

The snapshots also needed updating to reflect the fact that we now have an AccountID in the GuardDuty event/message.

It's my first contribution to this repo, so apologies in advance 😄

Motivation and Context

This PR was motivated by the same reasoning I saw in #164. We are using this module to send notifications from multiple AWS accounts to Slack and not having the AccountID visible in the notification was bugging us, as it makes the investigation slightly more tedious.

In order to add this attribute, I validated that even on a single (newly created) AWS account, the GuardDuty event always contains an AccountID attribute. The AWS documentation https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings_cloudwatch.html seems to indicate this too. This was achieved by triggering the sample events from the AWS console.

Breaking Changes

How Has This Been Tested?

  • I have updated at least one of the examples/* to demonstrate and validate my change(s)
  • I have tested and validated these changes using one or more of the provided examples/* projects
  • I have executed pre-commit run -a on my pull request

In order to add this attribute, I validated that even on a single (newly created) AWS account, the GuardDuty event always contains an `AccountID` attribute.

The AWS documentation https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings_cloudwatch.html seems to indicate this too.

I've modified the sample events and messages to add a bogus `accountId`. Running the `pipenv` commands as per the `README` made some formatting changes on `mylambda.py`, so I am leaving that as suggested by that run.

The snapshots also needed updating to reflect the fact that we now have an AccountID in the GuardDuty event/message.

Refs waysact/devops#9087
@bruno bruno changed the title Add account ID to GuardDuty findings feat: Add account ID to GuardDuty event notification Jan 23, 2023
@bruno
Copy link
Contributor Author

bruno commented Jan 23, 2023

I am confused by the failing tests, as I ran the pre-commit run -a locally:

❯ TAG=latest
❯ docker run -e "USERID=$(id -u):$(id -g)" -v $(pwd):/lint -w /lint ghcr.io/antonbabenko/pre-commit-terraform:$TAG run -a
Unable to find image 'ghcr.io/antonbabenko/pre-commit-terraform:latest' locally
[...]
Digest: sha256:64ce1e4b99d85497fe646db0724669039b079b45fa8cd503b4dc23dbdca490ae
Status: Downloaded newer image for ghcr.io/antonbabenko/pre-commit-terraform:latest
[INFO] Initializing environment for https://github.com/antonbabenko/pre-commit-terraform.
[INFO] Initializing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Installing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
Terraform fmt............................................................Passed
Terraform validate.......................................................Passed
Terraform docs...........................................................Passed
Terraform validate with tflint...........................................Passed
check for merge conflicts................................................Passed
fix end of files.........................................................Passed

Am I missing something?

@bryantbiggs
Copy link
Member

it looks like this workflow didn't get updated yet. If you update the same file from here https://github.com/terraform-aws-modules/terraform-aws-eks/blob/master/.github/workflows/pre-commit.yml in this PR it should run the tests successfully

The pre-commit.yml that I got from the other repo seems to have an extra line at the end, which appears to cause a failure in the TF pre-commit checks (oh, so meta).
@bruno
Copy link
Contributor Author

bruno commented Jan 26, 2023

Sorry @bryantbiggs just noticed that GitHub was complaining about master having moved forward underneath me, so I have fixed that. Thank you for approving the PR 🙇

@bryantbiggs bryantbiggs merged commit e3452b4 into terraform-aws-modules:master Jan 26, 2023
antonbabenko pushed a commit that referenced this pull request Jan 26, 2023
## [5.6.0](v5.5.0...v5.6.0) (2023-01-26)

### Features

* Add account ID to GuardDuty event notification ([#187](#187)) ([e3452b4](e3452b4))
@antonbabenko
Copy link
Member

This PR is included in version 5.6.0 🎉

@bruno bruno deleted the devops-9087 branch January 29, 2023 23:23
@github-actions
Copy link

github-actions bot commented Mar 1, 2023

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Mar 1, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants