Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security Lake Integration should support cross-account #276

Open
kclinden opened this issue Jun 20, 2024 · 1 comment · May be fixed by #657
Open

Security Lake Integration should support cross-account #276

kclinden opened this issue Jun 20, 2024 · 1 comment · May be fixed by #657
Assignees
Labels
level/task Task issue request/operational Operational requests type/enhancement Enhancement issue

Comments

@kclinden
Copy link

Is your feature request related to a problem? Please describe.
The 4.9.0 security lake integration currently assumes that the lambda function is running from the same account as AWS Security Lake. This should be ran from a different account the Lambda role should assume the Security Lake created role with an external id.

Describe the solution you'd like
Enhance the Security Lake integration to support cross account

Describe alternatives you've considered
Run the lambda in the same account as security lake which is not recommended by the AWS Security Reference Architecture

Additional context
Source - https://github.com/wazuh/wazuh-indexer/blob/4.9.0/integrations/amazon-security-lake/src/lambda_function.py#L50

@kclinden kclinden added level/task Task issue type/enhancement Enhancement issue labels Jun 20, 2024
@wazuhci wazuhci moved this to Backlog in Release 4.9.0 Jun 24, 2024
@havidarou havidarou removed this from Release 4.9.0 Jul 1, 2024
@QU3B1M QU3B1M self-assigned this Jan 28, 2025
@QU3B1M QU3B1M linked a pull request Jan 28, 2025 that will close this issue
3 tasks
@AlexRuiz7 AlexRuiz7 added the request/operational Operational requests label Jan 29, 2025
@QU3B1M
Copy link
Member

QU3B1M commented Jan 30, 2025

Update Security Lake integration to support cross-account, it is not mandatory but it will raise the warning Cross-account access is not being used. Lambda will run with default credentials from the same account. when not running from a different account.

Unit tests were implemented to validate this script functions

% pytest -v                                     
===================================================== test session starts =====================================================
platform darwin -- Python 3.13.0, pytest-8.3.4, pluggy-1.5.0 -- /Users/quebim_wz/IdeaProjects/wazuh-indexer/integrations/amazon-security-lake/venv/bin/python3.13
cachedir: .pytest_cache
rootdir: /Users/quebim_wz/IdeaProjects/wazuh-indexer/integrations/amazon-security-lake/tests
configfile: pytest.ini
collected 7 items                                                                                                             

test_lambda_function.py::test_lambda_handler PASSED                                                                     [ 14%]
test_lambda_function.py::test_assume_role PASSED                                                                        [ 28%]
test_lambda_function.py::test_get_s3_client PASSED                                                                      [ 42%]
test_lambda_function.py::test_get_events PASSED                                                                         [ 57%]
test_lambda_function.py::test_write_parquet_file PASSED                                                                 [ 71%]
test_lambda_function.py::test_upload_to_s3 PASSED                                                                       [ 85%]
test_lambda_function.py::test_get_full_key PASSED                                                                       [100%]

====================================================== 7 passed in 0.92s ======================================================

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
level/task Task issue request/operational Operational requests type/enhancement Enhancement issue
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants