Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: update ProductArn with account id #2782

Merged
merged 3 commits into from Sep 8, 2022
Merged

fix: update ProductArn with account id #2782

Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0d687d7
fix: update ProductArn with account id
AndrewCharlesHay Aug 25, 2022
f028672
fix: update arn to fix documentation better
AndrewCharlesHay Aug 31, 2022
3bbe513
docs: add product arn descripition
AndrewCharlesHay Sep 1, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 1 addition & 1 deletion contrib/asff.tpl
View file
Open in desktop
Expand Up @@ -82,7 +82,7 @@
{
"SchemaVersion": "2018-10-08",
"Id": "{{ $target }}/{{ .ID }}",
"ProductArn": "arn:aws:securityhub:{{ env "AWS_REGION" }}::product/aquasecurity/aquasecurity",
"ProductArn": "arn:aws:securityhub:{{ env "AWS_REGION" }}:{{ env "AWS_ACCOUNT_ID" }}:product/aquasecurity/trivy",
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not familiar with ASFF, but don't we need to keep it aquasecurity/aquasecurity?
https://github.com/aws-samples/aws-security-hub-scan-with-trivy/blob/49ca23f242603dd1b8043f22b670c5323d92b6da/sechub_parser.py#L74

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I remember there is permission importing findings to Security Hub. Isn't the ProductArn relevant?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@knqyf263 I took a loot at the documentation
https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssecurityhub.html

and found next definition of resource type product:

arn:${Partition}:securityhub:${Region}:${Account}:product/${Company}/${ProductId}

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@AndrewCharlesHay After you changed ProductArn, did you confirm the ASFF file could be imported into Security Hub?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah I have local version of this file with just the arn changed and I am able to upload to Security Hub

"GeneratorId": "Trivy/{{ .ID }}",
"AwsAccountId": "{{ env "AWS_ACCOUNT_ID" }}",
"Types": [ "Software and Configuration Checks" ],
Expand Down