Skip to content

Commit c35d79a

Browse files
ralongitralongit
committed
Upgrade AWS Security Hub to v0.0.2
- Upgraded Go support to v1.19 - Modified location of function files to new version 0.0.2. - Fixed CVE-2022-29526 - Upgraded the golang.org/x/sys dependency indirectly as it relates to this issue: sirupsen/logrus#1402 - Created a release workflow to publish to Cloudformation S3 buckets
1 parent 00b514f commit c35d79a

File tree

6 files changed

+214
-3
lines changed

6 files changed

+214
-3
lines changed

‎collector/go.mod

+15-1
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,24 @@
11
module aws-security-hub/collector
22

3-
go 1.15
3+
go 1.19
44

55
require (
66
github.com/aws/aws-lambda-go v1.26.0
77
github.com/logzio/logzio-go v1.0.2
88
github.com/sirupsen/logrus v1.8.1
99
github.com/stretchr/testify v1.6.1
1010
)
11+
12+
require (
13+
github.com/StackExchange/wmi v1.2.0 // indirect
14+
github.com/beeker1121/goque v2.1.0+incompatible // indirect
15+
github.com/davecgh/go-spew v1.1.1 // indirect
16+
github.com/go-ole/go-ole v1.2.5 // indirect
17+
github.com/golang/snappy v0.0.4 // indirect
18+
github.com/pmezard/go-difflib v1.0.0 // indirect
19+
github.com/shirou/gopsutil/v3 v3.21.6 // indirect
20+
github.com/syndtr/goleveldb v1.0.0 // indirect
21+
go.uber.org/atomic v1.9.0 // indirect
22+
golang.org/x/sys v0.1.0 // indirect; indirect, relates to: https://github.com/sirupsen/logrus/pull/1402
23+
gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776 // indirect
24+
)

‎collector/go.sum

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
2+
github.com/StackExchange/wmi v0.0.0-20180116203802-5d049714c4a6/go.mod h1:3eOhrUMpNV+6aFIbp5/iudMxNCF27Vw2OZgy4xEx0Fg=
3+
github.com/StackExchange/wmi v0.0.0-20190523213315-cbe66965904d/go.mod h1:3eOhrUMpNV+6aFIbp5/iudMxNCF27Vw2OZgy4xEx0Fg=
4+
github.com/StackExchange/wmi v1.2.0 h1:noJEYkMQVlFCEAc+2ma5YyRhlfjcWfZqk5sBRYozdyM=
5+
github.com/StackExchange/wmi v1.2.0/go.mod h1:3eOhrUMpNV+6aFIbp5/iudMxNCF27Vw2OZgy4xEx0Fg=
6+
github.com/aws/aws-lambda-go v1.26.0 h1:6ujqBpYF7tdZcBvPIccs98SpeGfrt/UOVEiexfNIdHA=
7+
github.com/aws/aws-lambda-go v1.26.0/go.mod h1:jJmlefzPfGnckuHdXX7/80O3BvUUi12XOkbv4w9SGLU=
8+
github.com/beeker1121/goque v2.1.0+incompatible h1:m5pZ5b8nqzojS2DF2ioZphFYQUqGYsDORq6uefUItPM=
9+
github.com/beeker1121/goque v2.1.0+incompatible/go.mod h1:L6dOWBhDOnxUVQsb0wkLve0VCnt2xJW/MI8pdRX4ANw=
10+
github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
11+
github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
12+
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
13+
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
14+
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
15+
github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
16+
github.com/go-ole/go-ole v1.2.1/go.mod h1:7FAglXiTm7HKlQRDeOQ6ZNUHidzCWXuZWq/1dTyBNF8=
17+
github.com/go-ole/go-ole v1.2.4/go.mod h1:XCwSNxSkXRo4vlyPy93sltvi/qJq0jqQhjqQNIwKuxM=
18+
github.com/go-ole/go-ole v1.2.5 h1:t4MGB5xEDZvXI+0rMjjsfBsD7yAgp/s9ZDkL1JndXwY=
19+
github.com/go-ole/go-ole v1.2.5/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
20+
github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
21+
github.com/golang/snappy v0.0.0-20180518054509-2e65f85255db/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
22+
github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
23+
github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
24+
github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI=
25+
github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
26+
github.com/logzio/logzio-go v1.0.2 h1:PM3+x2OEMku7VPrVa9AuT1+SR74vZQHVV+Sadqp1G9g=
27+
github.com/logzio/logzio-go v1.0.2/go.mod h1:N0FvvsuktlxK6Ed5mlxaZUxUmgghkh4elMqEQcDPEMc=
28+
github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
29+
github.com/onsi/ginkgo v1.7.0 h1:WSHQ+IS43OoUrWtD1/bbclrwK8TTH5hzp+umCiuxHgs=
30+
github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
31+
github.com/onsi/gomega v1.4.3 h1:RE1xgDvH7imwFD45h+u2SgIfERHlS2yNG4DObb5BSKU=
32+
github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
33+
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
34+
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
35+
github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
36+
github.com/shirou/gopsutil v0.0.0-20190323131628-2cbc9195c892/go.mod h1:WWnYX4lzhCH5h/3YBfyVA3VbLYjlMZZAQcW9ojMexNc=
37+
github.com/shirou/gopsutil/v3 v3.21.6 h1:vU7jrp1Ic/2sHB7w6UNs7MIkn7ebVtTb5D9j45o9VYE=
38+
github.com/shirou/gopsutil/v3 v3.21.6/go.mod h1:JfVbDpIBLVzT8oKbvMg9P3wEIMDDpVn+LwHTKj0ST88=
39+
github.com/shirou/w32 v0.0.0-20160930032740-bb4de0191aa4/go.mod h1:qsXQc7+bwAM3Q1u/4XEfrquwF8Lw7D7y5cD8CuHnfIc=
40+
github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
41+
github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
42+
github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
43+
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
44+
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
45+
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
46+
github.com/stretchr/testify v1.6.1 h1:hDPOHmpOpP40lSULcqw7IrRb/u7w6RpDC9399XyoNd0=
47+
github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
48+
github.com/syndtr/goleveldb v1.0.0 h1:fBdIW9lB4Iz0n9khmH8w27SJ3QEJ7+IgjPEwGSZiFdE=
49+
github.com/syndtr/goleveldb v1.0.0/go.mod h1:ZVVdQEZoIme9iO1Ch2Jdy24qqXrMMOU6lpPAyBWyWuQ=
50+
github.com/tidwall/gjson v1.8.1/go.mod h1:5/xDoumyyDNerp2U36lyolv46b3uF/9Bu6OfyQ9GImk=
51+
github.com/tidwall/match v1.0.3/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
52+
github.com/tidwall/pretty v1.1.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
53+
github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
54+
github.com/tklauser/go-sysconf v0.3.6/go.mod h1:MkWzOF4RMCshBAMXuhXJs64Rte09mITnppBXY/rYEFI=
55+
github.com/tklauser/numcpus v0.2.2/go.mod h1:x3qojaO3uyYt0i56EW/VUYs7uBvdl2fkfZFu0T9wgjM=
56+
github.com/urfave/cli/v2 v2.2.0/go.mod h1:SE9GqnLQmjVa0iPEY0f1w3ygNIYcIJ0OKPMoW2caLfQ=
57+
go.uber.org/atomic v1.9.0 h1:ECmE8Bn/WFTYwEW/bpKD3M8VtR/zQVbavAoalC1PYyE=
58+
go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
59+
golang.org/x/net v0.0.0-20180906233101-161cd47e91fd h1:nTDtHvHSdCn1m6ITfMRqtOd/9+7a3s8RBNOZ3eYZzJA=
60+
golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
61+
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
62+
golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
63+
golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
64+
golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
65+
golang.org/x/sys v0.0.0-20210316164454-77fc1eacc6aa/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
66+
golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
67+
golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
68+
golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
69+
golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
70+
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
71+
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
72+
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
73+
gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4=
74+
gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
75+
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
76+
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
77+
gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
78+
gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
79+
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
80+
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
81+
gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776 h1:tQIYjPdBoyREyB9XMu+nnTclpTYkz2zFM+lzLJFO4gQ=
82+
gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

‎collector/sam/template.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ Resources:
77
Properties:
88
Code:
99
S3Bucket: logzio-aws-integrations-us-east-1
10-
S3Key: aws-security-hub-collector/0.0.1/function.zip
10+
S3Key: aws-security-hub-collector/0.0.2/function.zip
1111
Description: >
1212
Go executable of lambda function that receives an AWS Security Hub event and sends it to logz.io.
1313
Environment:

‎go.mod

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
module aws-security-hub
22

3-
go 1.15
3+
go 1.19

‎release/main.py

+114
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
import os
2+
3+
import boto3
4+
5+
REGIONS = ['us-east-1', 'us-east-2', 'us-west-1', 'us-west-2',
6+
'ap-south-1', 'ap-northeast-3', 'ap-northeast-2', 'ap-southeast-1', 'ap-southeast-2', 'ap-northeast-1',
7+
'eu-central-1', 'eu-west-1', 'eu-west-2', 'eu-west-3', 'eu-north-1',
8+
'sa-east-1',
9+
'ca-central-1']
10+
11+
BUCKET_NAME_PREFIX = 'logzio-aws-integrations-'
12+
ENV_ACCESS_KEY = 'AWS_ACCESS_KEY'
13+
ENV_SECRET_KEY = 'AWS_SECRET_KEY'
14+
ENV_FOLDER_NAME = 'FOLDER_NAME'
15+
ENV_VERSION_NUMBER = 'VERSION_NUMBER'
16+
ENV_PATH_TO_FILE = 'PATH_TO_FILE'
17+
CF_TEMPLATE = 'template.yaml'
18+
CF_TEMPLATE_S3 = 'template.yaml'
19+
REGION_PLACEHOLDER = '<<REGION>>'
20+
VERSION_PLACEHOLDER = '<<VERSION>>'
21+
22+
23+
def upload_public_to_s3(access_key, secret_key, folder_name, version_number, path_to_file):
24+
s3 = get_s3_client(access_key, secret_key)
25+
file_name = path_to_file.split('/')[-1]
26+
print(f'File name: {file_name}')
27+
success = 0
28+
for region in REGIONS:
29+
try:
30+
print(f'Region: {region}')
31+
object_name = f'{folder_name}/{version_number}/{file_name}'
32+
bucket_name = f'{BUCKET_NAME_PREFIX}{region}'
33+
s3.upload_file(path_to_file, bucket_name, object_name, ExtraArgs={'ACL': 'public-read'})
34+
success += 1
35+
except Exception as e:
36+
print(f'Error occurred for region {region}: {e}')
37+
print('Skipping this region')
38+
39+
print(f'Uploaded to {success} regions')
40+
41+
42+
def cf_template_workflow(access_key, secret_key, folder_name, version_number, path_to_file):
43+
s3 = get_s3_client(access_key, secret_key)
44+
file_name = path_to_file.split('/')[-1]
45+
print(f'File name: {file_name}')
46+
success = 0
47+
base_arr = []
48+
with open(path_to_file, 'r') as base_file:
49+
base_arr = base_file.readlines()
50+
if len(base_arr) == 0:
51+
raise ValueError('Could not get base Cloudformation template')
52+
for region in REGIONS:
53+
try:
54+
print(f'Region: {region}')
55+
print(f'Version: {version_number}')
56+
tmp_arr = []
57+
for line in base_arr:
58+
tmp_line = line.replace(REGION_PLACEHOLDER, region)
59+
tmp_line = tmp_line.replace(VERSION_PLACEHOLDER, version_number)
60+
tmp_arr.append(tmp_line)
61+
new_path = f'./{file_name}'
62+
with open(new_path, 'w') as new_file:
63+
new_file.writelines(tmp_arr)
64+
object_name = f'{folder_name}/{version_number}/{file_name}'
65+
bucket_name = f'{BUCKET_NAME_PREFIX}{region}'
66+
s3.upload_file(new_path, bucket_name, object_name, ExtraArgs={'ACL': 'public-read'})
67+
success += 1
68+
except Exception as e:
69+
print(f'Error occurred for region {region}: {e}')
70+
print('Skipping this region')
71+
72+
print(f'Uploaded to {success} regions')
73+
os.remove(new_path)
74+
75+
76+
def get_s3_client(access_key, secret_key):
77+
session = boto3.Session(
78+
aws_access_key_id=access_key,
79+
aws_secret_access_key=secret_key,
80+
)
81+
82+
return session.client('s3')
83+
84+
85+
def upload():
86+
access_key = os.getenv(ENV_ACCESS_KEY)
87+
secret_key = os.getenv(ENV_SECRET_KEY)
88+
if access_key is None or access_key == '' or secret_key is None or secret_key == '':
89+
raise ValueError('AWS credentials missing! Exiting')
90+
folder_name = os.getenv(ENV_FOLDER_NAME)
91+
if folder_name is None or folder_name == '':
92+
raise ValueError('Missing folder name! Exiting')
93+
version_number = os.getenv(ENV_VERSION_NUMBER)
94+
if version_number is None or version_number == '':
95+
raise ValueError('Missing version number! Exiting')
96+
path_to_file = os.getenv(ENV_PATH_TO_FILE)
97+
if path_to_file is None or path_to_file == '':
98+
raise ValueError('Missing path to file! Exiting')
99+
file_exists = os.path.isfile(path_to_file)
100+
if not file_exists:
101+
raise FileNotFoundError(f'Provided path to file ({path_to_file}) does not exists! Exiting')
102+
try:
103+
is_cf_template = (path_to_file.split('/')[-1] == CF_TEMPLATE or path_to_file.split('/')[-1] == CF_TEMPLATE_S3)
104+
print(f'Is Cloudformation template: {is_cf_template}')
105+
if is_cf_template:
106+
cf_template_workflow(access_key, secret_key, folder_name, version_number, path_to_file)
107+
else:
108+
upload_public_to_s3(access_key, secret_key, folder_name, version_number, path_to_file)
109+
except Exception as e:
110+
print(f'Some error occurred while trying to upload file: {e}')
111+
112+
113+
if __name__ == '__main__':
114+
upload()

‎release/requirements.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
boto3==1.26.22

0 commit comments

Comments
 (0)