reference code for handle the scan result by Hundao · Pull Request #1 · Hundao/cloudone-filestorage-plugins

Hundao · 2022-07-24T23:58:17Z

TITLE

Change Summary

PR Checklist

I've read and followed the Contributing Guide.
Documents/Readmes
- Updated accordingly
- Not required
Plugins that have versioning
- Version bumped and follows Semantic Versioning
- Not required

Other Notes

trend-jack-c-tang

Suggest adding the output format in the doc.

trend-jack-c-tang · 2022-07-27T01:58:36Z

post-scan-actions/aws-python-publish-malware-to-sns/template.yml

+Metadata:
+  AWS::ServerlessRepo::Application:
+    Name: cloudone-filestorage-plugin-publish-malware-to-sns
+    Description: >-
+      According to the scan result from the scanner, publish the malware information
+      to the target SNS topic.
+    Author: Trend Micro Cloud One File Storage Security


We're not going to publish this to AWS serverless repository, so this is not required.

Will remove in next commit.

trend-jack-c-tang · 2022-07-27T02:01:35Z

post-scan-actions/aws-python-publish-malware-to-sns/template.yml

+  TargetSnsTopicName:
+    Type: String
+    Description: The name for the SNS topic to which malware information publish.


The customer may already have their own SNS topic. Could you figure out a way for using the existing SNS topic?

I will add 1 more parameter to let user fill in their customer SNS Topic ARN, and create a new one SNS topic if the value is empty string.

trend-jack-c-tang · 2022-07-27T02:03:47Z

post-scan-actions/aws-python-publish-malware-to-sns/template.yml

+  PublishMalwareLambdaName:
+    Type: String
+    Description: The name for the lambda function publishes the malware information to SNS topic.
+  PublishMalwarePolicyName:
+    Type: String
+    Description: The name for the policy includes sns and account authority.
+  PublishMalwareRoleName:
+    Type: String
+    Description: The name for the role to execute the lambda function.


For internal use resources, we usually don't let the customer choose the names. There might be problems, like name already existed, that would block customer from deploying the template. Any purpose for these parameters?

I will remove these and using the default name (stack name).

trend-jack-c-tang · 2022-07-27T02:05:10Z

post-scan-actions/aws-python-publish-malware-to-sns/template.yml

+      Handler: handler.lambda_handler
+      FunctionName: !Ref PublishMalwareLambdaName
+      Runtime: python3.8
+      Timeout: 500


How do you choose the timeout for this Lambda?

trend-jack-c-tang · 2022-07-27T02:07:47Z

post-scan-actions/aws-python-publish-malware-to-sns/template.yml

+    Properties:
+      FunctionName: !GetAtt PublishMalwareLambda.Arn
+      Action: lambda:InvokeFunction
+      Principal: events.amazonaws.com


This is the endpoint of AWS eventbridge. Should be sns.amazonaws.com?

Thanks, I'm very confused for why I can't receive the notification from SNS.

post-scan-actions/aws-python-publish-malware-to-sns/handler.py

trend-jack-c-tang · 2022-07-27T02:19:13Z

post-scan-actions/aws-python-publish-malware-to-sns/handler.py

+        for i, scan_result in enumerate(scan_results)
+    ]
+
+    response = sns_client.publish_batch(


SNS batch publish supports up to 10 messages, so be careful if the received events count would be more than 10. And you may need to handle partial failure cases.

trend-jack-c-tang · 2022-07-27T02:24:44Z

post-scan-actions/aws-python-publish-malware-to-sns/Makefile

+	--runtime python3.9 \
+	--timeout 30 \


They are not matched with ones in the template. Why?

Will align them in the next commit.

The runtime is not aligned still.

Sorry for the lost, fixed already.

trend-jack-c-tang · 2022-07-27T02:26:17Z

post-scan-actions/aws-python-publish-malware-to-sns/handler.py

+
+        scan_results.append({
+            'bucket_name': get_bucket_name(message['file_url']),
+            'account_name': fetch_account_name(),


Can the account name be cached?

Yup, move out from the for loop.

trend-jack-c-tang · 2022-07-28T08:36:04Z

post-scan-actions/aws-python-publish-malware-to-sns/Makefile

+	--runtime python3.9 \
+	--timeout 30 \


The runtime is not aligned still.

trend-jack-c-tang · 2022-07-28T08:48:20Z

post-scan-actions/aws-python-publish-malware-to-sns/handler.py

+
+    if fails:
+        print(fails)
+        raise ValueError('fail to publish sns.')


Unhandled error will make the Lambda retry the whole batch again. Some messages will be duplicated. In this case, I think we can just log them and let the execution finish successfully.

trend-jack-c-tang · 2022-07-28T08:50:24Z

post-scan-actions/aws-python-publish-malware-to-sns/template.yml

+        - Arn
+      Environment:
+        Variables:
+          TARGET_SNS_ARN: !If [NeedCreateNewSnsTopic, !Ref TargetSnsTopic, !Ref TargetSnsTopicArn, ]


Suggested change

TARGET_SNS_ARN: !If [NeedCreateNewSnsTopic, !Ref TargetSnsTopic, !Ref TargetSnsTopicArn, ]

TARGET_SNS_ARN: !If [ NeedCreateNewSnsTopic, !Ref TargetSnsTopic, !Ref TargetSnsTopicArn ]

Ryan_c_wu added 3 commits July 22, 2022 17:41

lambda for handle the scan result

caa3c62

add makefile and cloudformation template

353be9c

add makefile

d58a744

Hundao changed the title ~~lambda for handle the scan result~~ reference code for handle the scan result Jul 27, 2022

trend-jack-c-tang reviewed Jul 27, 2022

View reviewed changes

Ryan_c_wu and others added 2 commits July 27, 2022 13:49

refine PR

0a5f529

refine PR

e1eed5f

trend-jack-c-tang reviewed Jul 28, 2022

View reviewed changes

refine PR

22bf288

	TARGET_SNS_ARN: !If [NeedCreateNewSnsTopic, !Ref TargetSnsTopic, !Ref TargetSnsTopicArn, ]
	TARGET_SNS_ARN: !If [ NeedCreateNewSnsTopic, !Ref TargetSnsTopic, !Ref TargetSnsTopicArn ]

Conversation

Hundao commented Jul 24, 2022

TITLE

Change Summary

PR Checklist

Other Notes

Uh oh!

trend-jack-c-tang left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Hundao Jul 27, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Hundao Jul 27, 2022 •

edited

Loading