aws-remediate-cis-securityhub/cft/aws-cis-securityhubactions.yml [18:80]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Description: Custom resource to create an action target in Security Hub
      Handler: index.lambda_handler
      MemorySize: 256
      Role: !GetAtt CreateSecurityHubCustomActionTargetLambdaRole.Arn
      Runtime: python3.7
      Timeout: 60
      Code:
        ZipFile: |
          import boto3
          import cfnresponse
          import os
          def lambda_handler(event, context):
              try:
                  properties = event['ResourceProperties']
                  region = os.environ['AWS_REGION']
                  client = boto3.client('securityhub', region_name=region)
                  responseData = {}
                  if event['RequestType'] == 'Create':
                      response = client.create_action_target(
                          Name=properties['Name'],
                          Description=properties['Description'],
                          Id=properties['Id']
                      )
                      responseData['Arn'] = response['ActionTargetArn']
                  elif event['RequestType'] == 'Delete':
                      account_id = context.invoked_function_arn.split(":")[4]
                      client.delete_action_target(
                          ActionTargetArn=f"arn:aws:securityhub:{region}:{account_id}:action/custom/{properties['Id']}"
                      )
                  cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData)
              except Exception as e:
                  print(e)
                  cfnresponse.send(event, context, cfnresponse.FAILED, {})
  CreateSecurityHubCustomActionTargetLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      Policies:
      - PolicyName: CreateActionTarget-LambdaPolicy
        PolicyDocument:
          Version: 2012-10-17
          Statement:
          - Effect: Allow
            Action:
            - cloudwatch:PutMetricData
            Resource: '*'
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            Resource: '*'
          - Effect: Allow
            Action:
            - securityhub:CreateActionTarget
            - securityhub:DeleteActionTarget
            Resource: '*'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal: { Service: lambda.amazonaws.com }
          Action:
          - sts:AssumeRole
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



aws-remediate-fsbp-securityhub/cft/aws-security-hub-fsbp-remediations-template2.yml [16:79]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Description: Custom resource to create an action target in Security Hub
      Handler: index.lambda_handler
      MemorySize: 256
      Role: !GetAtt CreateSecurityHubCustomActionTargetLambdaRole.Arn
      Runtime: python3.7
      Timeout: 60
      Code:
        ZipFile: |
          import boto3
          import cfnresponse
          import os
          def lambda_handler(event, context):
              try:
                  properties = event['ResourceProperties']
                  region = os.environ['AWS_REGION']
                  client = boto3.client('securityhub', region_name=region)
                  responseData = {}
                  if event['RequestType'] == 'Create':
                      response = client.create_action_target(
                          Name=properties['Name'],
                          Description=properties['Description'],
                          Id=properties['Id']
                      )
                      responseData['Arn'] = response['ActionTargetArn']
                  elif event['RequestType'] == 'Delete':
                      account_id = context.invoked_function_arn.split(":")[4]
                      client.delete_action_target(
                          ActionTargetArn=f"arn:aws:securityhub:{region}:{account_id}:action/custom/{properties['Id']}"
                      )
                  cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData)
              except Exception as e:
                  print(e)
                  cfnresponse.send(event, context, cfnresponse.FAILED, {})
  
  CreateSecurityHubCustomActionTargetLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      Policies:
      - PolicyName: CreateActionTarget-LambdaPolicy
        PolicyDocument:
          Version: 2012-10-17
          Statement:
          - Effect: Allow
            Action:
            - cloudwatch:PutMetricData
            Resource: '*'
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            Resource: '*'
          - Effect: Allow
            Action:
            - securityhub:CreateActionTarget
            - securityhub:DeleteActionTarget
            Resource: '*'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal: { Service: lambda.amazonaws.com }
          Action:
          - sts:AssumeRole
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



