atheiman

# See documented events sent by Config here: https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_develop-rules_example-events.html
#
# It is much easier to write evaluations for rules using ConfigurationItemChangeNotification and
# OversizedConfigurationItemChangeNotification. These notifications include the resource as recorded
# by Config. The Lambda function can review the resource config json and submit an evaluation for
# the resource.
#
# ScheduledNotification events are not specific to a resource, the event only includes
# the account id and rule name. Lambda functions must list all the resources in the account using
# service apis, call the appropriate apis to evaluate the resources config, and then submit

atheiman

# Package docker image to .tar.gz to share to another machine
docker pull alpine
docker save alpine | gzip > alpine.tar.gz

# Load docker image from .tar.gz
docker load < alpine.tar.gz

# Show loaded image
docker image ls alpine
# REPOSITORY   TAG       IMAGE ID       CREATED         SIZE

atheiman

import json
import boto3
import os
import traceback as tb

if boto3.session.Session().region_name.startswith("us-gov-"):
    partition = "aws-us-gov"
    regions = ["us-gov-west-1", "us-gov-east-1"]
else:
    partition = "aws"

atheiman

#!/usr/bin/env python3

import boto3
import os

# Example usage from a bash shell:
# PREFIX='AWS COMM' AWS_PROFILE=comm-mgmt ROLE_NAME=AWSControlTowerExecution python ./aws_switch_role_bookmark_generator.py > "./aws-switch-role-bookmarks.html"

# Environment variables for configuration
role_name = os.environ.get("ROLE_NAME", "OrganizationAccountAccessRole")

atheiman

#!/usr/bin/env python

import json
import boto3

default_region = boto3.Session().region_name
if default_region.startswith("us-gov-"):
    partition = "aws-us-gov"
    regions = ["us-gov-west-1", "us-gov-east-1"]
else:

atheiman

#!/usr/bin/env python

import boto3
import json

sechub = boto3.client("securityhub")
sts = boto3.client("sts")

caller_arn = sts.get_caller_identity()["Arn"]
print(caller_arn)

atheiman

# aws cloudformation deploy \
#   --profile mgmt \
#   --template-file ./template.yml \
#   --stack-name ConfigRuleAccountTags \
#   --capabilities CAPABILITY_IAM

Resources:
  ConfigRule:
    Type: AWS::Config::ConfigRule
    DependsOn: EvaluationFunctionConfigPermission

atheiman

from ipaddress import IPv4Network, IPv4Address, summarize_address_range
import json
import os


def lambda_handler(event, context):
    print(json.dumps(event))

    # Basic event validation
    if "cidrs" not in event or not isinstance(event["cidrs"], list) or len(event["cidrs"]) < 1:

atheiman

Resources:
  SecurityHubFindingUpdateFunction:
    Type: AWS::Lambda::Function
    Properties:
      Description: Applies metadata to Security Hub findings
      Role: !Sub '${SecurityHubFindingUpdateFunctionRole.Arn}'
      # ReservedConcurrentExecutions can be used to throttle the function if invocations get too
      # high. However, all findings may not be updated.
      #ReservedConcurrentExecutions: 3
      Environment:

atheiman

def dict_dot_notation(d, path=[]):
    d2 = {}
    for k, v in d.items():
        k_path = path + [str(k)]
        k_formatted = ".".join(k_path)

        if isinstance(v, dict):
            # merge in dict with recursive call
            d2 = {**d2, **dict_dot_notation(v, path=k_path)}
        elif isinstance(v, list) or isinstance(v, tuple):