aws-remediate-pci-securityhub/cft/aws-security-hub-pci-remediations-template2.yml [235:300]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Handler: index.lambda_handler
      MemorySize: 256
      Role: !GetAtt  S3RemediationLambdaRole.Arn
      Runtime: python3.7
      Timeout: 60
      Code:
        ZipFile: |
          import boto3
          import json
          import os
          def lambda_handler(event, context):
            
              S3BucketArn = str(event['detail']['findings'][0]['Resources'][0]['Id'])
              Id = str(event['detail']['findings'][0]['Id'])
              S3BucketName = S3BucketArn.replace("arn:aws:s3:::", "")
              ssm = boto3.client('ssm')
              try:
                  response = ssm.start_automation_execution(
                      DocumentName='AWS-DisableS3BucketPublicReadWrite',
                      DocumentVersion='1', # default
                      Parameters={
                          'S3BucketName': [ S3BucketName ]
                      }
                  )

              except Exception as e:
                  print(e)
                  print("SSM automation execution error")
                  raise

  S3RemediationLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      Policies:
      - PolicyName: S3RemediationLambdaPolicy
        PolicyDocument:
          Version: 2012-10-17
          Statement:
          - Effect: Allow
            Action:
            - cloudwatch:PutMetricData
            Resource: '*'
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            Resource: '*'
          - Effect: Allow
            Action:
            - ssm:StartAutomationExecution
            - s3:GetBucketAcl
            - s3:GetBucketPolicy
            - s3:PutBucketAcl
            - s3:PutBucketPolicy
            - s3:PutBucketPublicAccessBlock
            - iam:PassRole
            - securityhub:UpdateFindings
            Resource: '*'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal: { Service: lambda.amazonaws.com }
          Action:
          - sts:AssumeRole
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



aws-remediate-pci-securityhub/cft/aws-security-hub-pci-remediations-template2.yml [351:416]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Handler: index.lambda_handler
      MemorySize: 256
      Role: !GetAtt  S3RemediationLambdaRole.Arn
      Runtime: python3.7
      Timeout: 60
      Code:
        ZipFile: |
          import boto3
          import json
          import os
          def lambda_handler(event, context):
            
              S3BucketArn = str(event['detail']['findings'][0]['Resources'][0]['Id'])
              Id = str(event['detail']['findings'][0]['Id'])
              S3BucketName = S3BucketArn.replace("arn:aws:s3:::", "")
              ssm = boto3.client('ssm')
              try:
                  response = ssm.start_automation_execution(
                      DocumentName='AWS-DisableS3BucketPublicReadWrite',
                      DocumentVersion='1', # default
                      Parameters={
                          'S3BucketName': [ S3BucketName ]
                      }
                  )

              except Exception as e:
                  print(e)
                  print("SSM automation execution error")
                  raise

  S3RemediationLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      Policies:
      - PolicyName: S3RemediationLambdaPolicy
        PolicyDocument:
          Version: 2012-10-17
          Statement:
          - Effect: Allow
            Action:
            - cloudwatch:PutMetricData
            Resource: '*'
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            Resource: '*'
          - Effect: Allow
            Action:
            - ssm:StartAutomationExecution
            - s3:GetBucketAcl
            - s3:GetBucketPolicy
            - s3:PutBucketAcl
            - s3:PutBucketPolicy
            - s3:PutBucketPublicAccessBlock
            - iam:PassRole
            - securityhub:UpdateFindings
            Resource: '*'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal: { Service: lambda.amazonaws.com }
          Action:
          - sts:AssumeRole
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



