Skip to content

Commit f3c57b7

Browse files
nshalabhnshalabh
authored
Merge pull request #334 from nshalabh/main
fix: remove event info logging across all the lambdas, to prevent potential leak of sensitive customer data
2 parents 21ace18 + c86c3de commit f3c57b7

File tree

22 files changed

+80
-190
lines changed
  • aws_sra_examples/solutions
    • account/account_alternate_contacts/lambda/src
    • ami_bakery/ami_bakery_org/lambda/src
    • cloudtrail/cloudtrail_org/lambda/src
    • common
      • common_prerequisites/lambda/src
      • common_register_delegated_administrator/lambda/src
    • config
      • config_management_account/lambda/src
      • config_org/lambda/src
    • detective/detective_org/lambda/src
    • ec2/ec2_default_ebs_encryption/lambda/src
    • firewall_manager/firewall_manager_org/lambda/src
    • genai
      • bedrock_guardrails/lambda/src
      • bedrock_org/lambda
    • guardduty/guardduty_org/lambda/src
    • iam/iam_password_policy/lambda/src
    • inspector/inspector_org/lambda/src
    • macie/macie_org/lambda/src
    • patch_mgmt/patch_mgmt_org/lambda/src
    • s3/s3_block_account_public_access/lambda/src
    • security_lake/security_lake_org/lambda/src
    • securityhub/securityhub_org/lambda/src
    • shield_advanced/shield_advanced/lambda/src

22 files changed

+80
-190
lines changed

‎aws_sra_examples/solutions/account/account_alternate_contacts/lambda/src/app.py‎

Lines changed: 8 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -316,7 +316,7 @@ def local_testing(aws_account: AccountTypeDef, params: dict) -> None:
316316
process_alternate_contacts(account_client, aws_account, params)
317317

318318

319-
def process_accounts(event: Union[CloudFormationCustomResourceEvent, dict], params: dict) -> None:
319+
def process_accounts(event: Union[CloudFormationCustomResourceEvent, dict], params: dict) -> None: # noqa: U100
320320
"""Process Accounts and Create SNS Messages for each account for solution deployment.
321321
322322
Args:
@@ -339,7 +339,7 @@ def process_accounts(event: Union[CloudFormationCustomResourceEvent, dict], para
339339
process_sns_message_batches(sns_messages, params["SNS_TOPIC_ARN"])
340340

341341

342-
def process_account(event: dict, aws_account_id: str, params: dict) -> None:
342+
def process_account(event: dict, aws_account_id: str, params: dict) -> None: # noqa: U100
343343
"""Process Account and Create SNS Message for account for solution deployment.
344344
345345
Args:
@@ -359,20 +359,18 @@ def process_account(event: dict, aws_account_id: str, params: dict) -> None:
359359
publish_sns_message(sns_message, "Account Alternate Contacts", params["SNS_TOPIC_ARN"])
360360

361361

362-
def process_event(event: dict) -> None:
362+
def process_event(event: dict) -> None: # noqa: U100
363363
"""Process Event.
364364
365365
Args:
366366
event: event data
367367
"""
368-
event_info = {"Event": event}
369-
LOGGER.info(event_info)
370368
params = get_validated_parameters({})
371369

372370
process_accounts(event, params)
373371

374372

375-
def process_event_sns(event: dict) -> None:
373+
def process_event_sns(event: dict) -> None: # noqa: U100
376374
"""Process SNS event.
377375
378376
Args:
@@ -392,14 +390,12 @@ def process_event_sns(event: dict) -> None:
392390
process_alternate_contacts(account_client, aws_account, params)
393391

394392

395-
def process_event_organizations(event: dict) -> None:
393+
def process_event_organizations(event: dict) -> None: # noqa: U100
396394
"""Process Event from AWS Organizations.
397395
398396
Args:
399397
event: event data
400398
"""
401-
event_info = {"Event": event}
402-
LOGGER.info(event_info)
403399
params = get_validated_parameters({})
404400

405401
if event["detail"]["eventName"] == "TagResource" and params["EXCLUDE_ACCOUNT_TAGS"]:
@@ -418,7 +414,7 @@ def process_event_organizations(event: dict) -> None:
418414
LOGGER.info("Organization event does not match expected values.")
419415

420416

421-
def process_event_lifecycle(event: dict) -> None:
417+
def process_event_lifecycle(event: dict) -> None: # noqa: U100
422418
"""Process Lifecycle Event from AWS Control Tower.
423419
424420
Args:
@@ -427,8 +423,6 @@ def process_event_lifecycle(event: dict) -> None:
427423
Raises:
428424
ValueError: Control Tower Lifecycle Event not 'createManagedAccountStatus' or 'updateManagedAccountStatus'
429425
"""
430-
event_info = {"Event": event}
431-
LOGGER.info(event_info)
432426
params = get_validated_parameters({})
433427

434428
aws_account_id = ""
@@ -455,9 +449,6 @@ def process_event_cloudformation(event: CloudFormationCustomResourceEvent, conte
455449
Returns:
456450
AWS CloudFormation physical resource id
457451
"""
458-
event_info = {"Event": event}
459-
LOGGER.info(event_info)
460-
461452
if event["RequestType"] in ["Create", "Update"]:
462453
params = get_validated_parameters({"RequestType": event["RequestType"]})
463454
process_accounts(event, params)
@@ -588,7 +579,7 @@ def get_validated_parameters(event: dict) -> dict:
588579
return params
589580

590581

591-
def orchestrator(event: dict, context: Any) -> None:
582+
def orchestrator(event: dict, context: Any) -> None: # noqa: U100
592583
"""Orchestration of Events.
593584
594585
Args:
@@ -607,7 +598,7 @@ def orchestrator(event: dict, context: Any) -> None:
607598
process_event(event)
608599

609600

610-
def lambda_handler(event: dict, context: Any) -> None:
601+
def lambda_handler(event: dict, context: Any) -> None: # noqa: U100
611602
"""Lambda Handler.
612603
613604
Args:
@@ -619,8 +610,6 @@ def lambda_handler(event: dict, context: Any) -> None:
619610
"""
620611
LOGGER.info("....Lambda Handler Started....")
621612
try:
622-
event_info = {"Event": event}
623-
LOGGER.info(event_info)
624613
orchestrator(event, context)
625614
except Exception:
626615
LOGGER.exception(UNEXPECTED)

‎aws_sra_examples/solutions/ami_bakery/ami_bakery_org/lambda/src/app.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -299,7 +299,7 @@ def delete(event: Dict[str, Any], context: Context) -> None: # noqa: U100
299299
iam.delete_role(session, params["CODEPIPELINE_ROLE_NAME"])
300300

301301

302-
def lambda_handler(event: Dict[str, Any], context: Context) -> None:
302+
def lambda_handler(event: Dict[str, Any], context: Context) -> None: # noqa: U100
303303
"""Lambda Handler.
304304
305305
Args:

‎aws_sra_examples/solutions/cloudtrail/cloudtrail_org/lambda/src/app.py‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -313,7 +313,7 @@ def process_create_update(params: dict) -> None:
313313
@helper.create
314314
@helper.update
315315
@helper.delete
316-
def process_event(event: CloudFormationCustomResourceEvent, context: Context) -> str:
316+
def process_event(event: CloudFormationCustomResourceEvent, context: Context) -> str: # noqa: U100
317317
"""Process CloudFormation Event. Creates, updates, and deletes a CloudTrail with the provided parameters.
318318
319319
Args:
@@ -323,8 +323,6 @@ def process_event(event: CloudFormationCustomResourceEvent, context: Context) ->
323323
Returns:
324324
AWS CloudFormation physical resource id
325325
"""
326-
event_info = {"Event": event}
327-
LOGGER.info(event_info)
328326
LOGGER.debug(f"{context}")
329327

330328
params = get_validated_parameters(event)
@@ -342,7 +340,7 @@ def process_event(event: CloudFormationCustomResourceEvent, context: Context) ->
342340
return f"{params['CLOUDTRAIL_NAME']}-CloudTrail"
343341

344342

345-
def lambda_handler(event: CloudFormationCustomResourceEvent, context: Context) -> None:
343+
def lambda_handler(event: CloudFormationCustomResourceEvent, context: Context) -> None: # noqa: U100
346344
"""Lambda Handler.
347345
348346
Args:
@@ -360,7 +358,7 @@ def lambda_handler(event: CloudFormationCustomResourceEvent, context: Context) -
360358
raise ValueError(f"Unexpected error executing Lambda function. Review CloudWatch logs '{context.log_group_name}' for details.") from None
361359

362360

363-
def terraform_handler(event: CloudFormationCustomResourceEvent, context: Context) -> None:
361+
def terraform_handler(event: CloudFormationCustomResourceEvent, context: Context) -> None: # noqa: U100
364362
"""Lambda Handler.
365363
366364
Args:

‎aws_sra_examples/solutions/common/common_prerequisites/lambda/src/app.py‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -444,8 +444,6 @@ def create_update_event(event: CloudFormationCustomResourceEvent, context: Conte
444444
Returns:
445445
AWS CloudFormation physical resource id
446446
"""
447-
event_info = {"Event": event}
448-
LOGGER.info(event_info)
449447
params = get_validated_parameters(event)
450448
tags: Sequence[TagTypeDef] = [{"Key": params["TAG_KEY"], "Value": params["TAG_VALUE"]}]
451449

@@ -473,13 +471,11 @@ def delete_event(event: CloudFormationCustomResourceEvent, context: Context) ->
473471
event: event data
474472
context: runtime information
475473
"""
476-
event_info = {"Event": event}
477-
LOGGER.info(event_info)
478474
LOGGER.info("SRA SSM Parameters are being retained.")
479475
# delete_ssm_parameters_in_regions(get_enabled_regions()) # noqa: E800
480476

481477

482-
def lambda_handler(event: CloudFormationCustomResourceEvent, context: Context) -> None:
478+
def lambda_handler(event: CloudFormationCustomResourceEvent, context: Context) -> None: # noqa: U100
483479
"""Lambda Handler.
484480
485481
Args:

‎aws_sra_examples/solutions/common/common_register_delegated_administrator/lambda/src/app.py‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -265,7 +265,7 @@ def lambda_handler(
265265
raise ValueError(f"Unexpected error executing Lambda function. Review CloudWatch logs '{context.log_group_name}' for details.") from None
266266

267267

268-
def terraform_handler(event: dict, context: Context) -> None:
268+
def terraform_handler(event: dict, context: Context) -> None: # noqa: U100
269269
"""Lambda Handler.
270270
271271
Args:
@@ -276,8 +276,6 @@ def terraform_handler(event: dict, context: Context) -> None:
276276
ValueError: Unexpected error executing Lambda function
277277
"""
278278
LOGGER.info("....Lambda Handler Started....")
279-
event_info = {"Event": event}
280-
LOGGER.info(event_info)
281279
try:
282280
request_type = event["RequestType"]
283281

‎aws_sra_examples/solutions/config/config_management_account/lambda/src/app.py‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,7 @@ def get_validated_parameters(event: CloudFormationCustomResourceEvent) -> dict:
161161
@helper.create
162162
@helper.update
163163
@helper.delete
164-
def process_event(event: CloudFormationCustomResourceEvent, context: Context) -> str:
164+
def process_event(event: CloudFormationCustomResourceEvent, context: Context) -> str: # noqa: U100
165165
"""Process Event from AWS CloudFormation.
166166
167167
Args:
@@ -171,8 +171,6 @@ def process_event(event: CloudFormationCustomResourceEvent, context: Context) ->
171171
Returns:
172172
AWS CloudFormation physical resource id
173173
"""
174-
event_info = {"Event": event}
175-
LOGGER.info(event_info)
176174
params = get_validated_parameters(event)
177175

178176
management_account: str = context.invoked_function_arn.split(":")[4]
@@ -189,7 +187,7 @@ def process_event(event: CloudFormationCustomResourceEvent, context: Context) ->
189187
return f"{params['AUDIT_ACCOUNT_ID']}-{params['AGGREGATOR_NAME']}"
190188

191189

192-
def lambda_handler(event: CloudFormationCustomResourceEvent, context: Context) -> None:
190+
def lambda_handler(event: CloudFormationCustomResourceEvent, context: Context) -> None: # noqa: U100
193191
"""Lambda Handler.
194192
195193
Args:

‎aws_sra_examples/solutions/config/config_org/lambda/src/app.py‎

Lines changed: 5 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -68,14 +68,12 @@ def process_add_update_event(params: dict, regions: list, accounts: list) -> Non
6868
LOGGER.info("...ADD_UPDATE_NO_EVENT")
6969

7070

71-
def process_event(event: dict) -> None:
71+
def process_event(event: dict) -> None: # noqa: U100
7272
"""Process Event.
7373
7474
Args:
7575
event: event data
7676
"""
77-
event_info = {"Event": event}
78-
LOGGER.info(event_info)
7977
params = get_validated_parameters({"RequestType": "Update"})
8078

8179
accounts = common.get_active_organization_accounts()
@@ -111,14 +109,12 @@ def process_account(aws_account_id: str, params: dict) -> None:
111109
config.set_delivery_channel(aws_account_id, region, params["CONFIGURATION_ROLE_NAME"], delivery_channel)
112110

113111

114-
def process_event_organizations(event: dict) -> None:
112+
def process_event_organizations(event: dict) -> None: # noqa: U100
115113
"""Process Event from AWS Organizations.
116114
117115
Args:
118116
event: event data
119117
"""
120-
event_info = {"Event": event}
121-
LOGGER.info(event_info)
122118
params = get_validated_parameters({})
123119

124120
if event["detail"]["eventName"] == "AcceptHandshake" and event["detail"]["responseElements"]["handshake"]["state"] == "ACCEPTED":
@@ -432,7 +428,7 @@ def process_sns_message_batches(sns_messages: list, sns_topic_arn_fanout: str) -
432428
publish_sns_message_batch(batch, sns_topic_arn_fanout)
433429

434430

435-
def process_event_sns(event: dict) -> None:
431+
def process_event_sns(event: dict) -> None: # noqa: U100
436432
"""Process SNS event to complete the setup process.
437433
438434
Args:
@@ -481,9 +477,6 @@ def process_event_cloudformation(event: CloudFormationCustomResourceEvent, conte
481477
Returns:
482478
AWS CloudFormation physical resource id
483479
"""
484-
event_info = {"Event": event}
485-
LOGGER.info(event_info)
486-
487480
params = get_validated_parameters({"RequestType": event["RequestType"]})
488481
accounts = common.get_active_organization_accounts()
489482
regions = common.get_enabled_regions(params["ENABLED_REGIONS"], params["CONTROL_TOWER_REGIONS_ONLY"] == "true")
@@ -502,7 +495,7 @@ def process_event_cloudformation(event: CloudFormationCustomResourceEvent, conte
502495
return "SRA-CONFIG-ORG"
503496

504497

505-
def orchestrator(event: Dict[str, Any], context: Any) -> None:
498+
def orchestrator(event: Dict[str, Any], context: Any) -> None: # noqa: U100
506499
"""Orchestration.
507500
508501
Args:
@@ -520,7 +513,7 @@ def orchestrator(event: Dict[str, Any], context: Any) -> None:
520513
process_event(event)
521514

522515

523-
def lambda_handler(event: Dict[str, Any], context: Any) -> None:
516+
def lambda_handler(event: Dict[str, Any], context: Any) -> None: # noqa: U100
524517
"""Lambda Handler.
525518
526519
Args:
@@ -533,8 +526,6 @@ def lambda_handler(event: Dict[str, Any], context: Any) -> None:
533526
LOGGER.info("....Lambda Handler Started....")
534527
boto3_version = boto3.__version__
535528
LOGGER.info(f"boto3 version: {boto3_version}")
536-
event_info = {"Event": event}
537-
LOGGER.info(event_info)
538529
try:
539530
orchestrator(event, context)
540531
except Exception:

‎aws_sra_examples/solutions/detective/detective_org/lambda/src/app.py‎

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -66,14 +66,12 @@ def process_add_update_event(params: dict, regions: list, accounts: list) -> Non
6666
LOGGER.info("...ADD_UPDATE_NO_EVENT")
6767

6868

69-
def process_event(event: dict) -> None:
69+
def process_event(event: dict) -> None: # noqa: U100
7070
"""Process Event.
7171
7272
Args:
7373
event: event data
7474
"""
75-
event_info = {"Event": event}
76-
LOGGER.info(event_info)
7775
params = get_validated_parameters({"RequestType": "Update"})
7876

7977
excluded_accounts: list = [params["DELEGATED_ADMIN_ACCOUNT_ID"]]
@@ -366,9 +364,6 @@ def process_event_cloudformation(event: CloudFormationCustomResourceEvent, conte
366364
Returns:
367365
AWS CloudFormation physical resource id
368366
"""
369-
event_info = {"Event": event}
370-
LOGGER.info(event_info)
371-
372367
params = get_validated_parameters({"RequestType": event["RequestType"]})
373368
excluded_accounts: list = [params["DELEGATED_ADMIN_ACCOUNT_ID"]]
374369
accounts = common.get_active_organization_accounts(excluded_accounts)
@@ -384,7 +379,7 @@ def process_event_cloudformation(event: CloudFormationCustomResourceEvent, conte
384379
return f"sra-detective-org-{params['DELEGATED_ADMIN_ACCOUNT_ID']}"
385380

386381

387-
def orchestrator(event: Dict[str, Any], context: Any) -> None:
382+
def orchestrator(event: Dict[str, Any], context: Any) -> None: # noqa: U100
388383
"""Orchestration.
389384
390385
Args:
@@ -399,7 +394,7 @@ def orchestrator(event: Dict[str, Any], context: Any) -> None:
399394
process_event(event)
400395

401396

402-
def lambda_handler(event: Dict[str, Any], context: Any) -> None:
397+
def lambda_handler(event: Dict[str, Any], context: Any) -> None: # noqa: U100
403398
"""Lambda Handler.
404399
405400
Args:
@@ -412,8 +407,6 @@ def lambda_handler(event: Dict[str, Any], context: Any) -> None:
412407
LOGGER.info("....Lambda Handler Started....")
413408
boto3_version = boto3.__version__
414409
LOGGER.info(f"boto3 version: {boto3_version}")
415-
event_info = {"Event": event}
416-
LOGGER.info(event_info)
417410
try:
418411
orchestrator(event, context)
419412
except Exception:

0 commit comments

Comments
 (0)