module3/ec2-sechub-custom-actions.yml [16:38]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    actions:
        # Disassociate instance profile by not setting a name, thus any api attempts from instance will get implicit denies
      - type: set-instance-profile
        # snapshot the disk for forensics
      - type: snapshot
        copy-tags: [Name]
        # stop the instance
      - stop

  - name: DisableKey
    description: Disables access keys of the user
    resource: iam-user
    mode:
        type: hub-action
        role: arn:aws:iam::{account_id}:role/CloudCustodian
        member-role: arn:aws:iam::{account_id}:role/CloudCustodianMember
        memory: 128
        #packages: [botocore, boto3, urllib3, aws_xray_sdk]
        #execution-options:
        #  tracer: xray
        tags:
          CostCenter: SecurityHubWorkshop
          CreatedBy: CloudCustodian
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



module3/trace-ec2-sechub-custom-actions.yml [15:34]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    actions:
        # Disassociate instance profile by not setting a name, thus any api attempts from instance will get implicit denies
      - type: set-instance-profile
        # snapshot the disk for forensics
      - type: snapshot
        copy-tags: [Name]
        # stop the instance
      - stop

  - name: DisableKey
    description: Disables access keys of the user
    resource: iam-user
    mode:
        type: hub-action
        role: arn:aws:iam::{account_id}:role/CloudCustodian
        member-role: arn:aws:iam::{account_id}:role/CloudCustodianMember
        memory: 128
        tags:
          CostCenter: SecurityHubWorkshop
          CreatedBy: CloudCustodian
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



