in lambda/guardduty_to_acl_lambda.py [0:0]
def admin_notify(iphost, findingtype, naclid, region, instanceid, findingid):
MESSAGE = ("GuardDuty to ACL Event Info:\r\n"
"Suspicious activity detected from host " + iphost + " due to " + findingtype +
"against EC2 Instance: " + instanceid + ". The following ACL resources were targeted for update as needed: " + '\n'
"CloudFront IP Set: " + CLOUDFRONT_IP_SET + '\n'
"Regional IP Set: " + REGIONAL_IP_SET + '\n'
"VPC NACL: " + naclid + '\n'
"Region: " + region + '\n'
"Finding Link: " + "https://console.aws.amazon.com/guardduty/home?region=" + region + "#/findings?macros=current&search=id%3D" + findingid
)
sns = boto3.client(service_name="sns")
# Try to send the notification.
try:
sns.publish(
TopicArn = SNSTOPIC,
Message = MESSAGE,
Subject='AWS GD2ACL Alert'
)
logger.info("log -- send notification sent to SNS Topic: %s" % (SNSTOPIC))
# Display an error if something goes wrong.
except ClientError as e:
logger.error('log -- error sending notification.')
raise