ops/matrix-ops-bot
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Starting support for AWS SNS cloudtrail event

Browse source
This commit is contained in:
Abel Luck 2025-01-31 16:25:25 +01:00
parent 2a5a95ccaf
commit 7c06e91ea8
2 changed files with 210 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

114
tests/test_ops_bot.py
View file

@ -45,6 +45,106 @@ sns_notification = """{
"UnsubscribeURL" : "https://sns.us-west-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-west-2:123456789012:MyTopic:c9135db0-26c4-47ec-8998-413945fb5a96"
}"""
sns_signin = """
{
"version": "0",
"id": "000000-e441-44ce-22c1-00000000",
"detail-type": "AWS Console Sign In via CloudTrail",
"source": "aws.signin",
"account": "1234567890",
"time": "2025-01-31T14:03:15Z",
"region": "eu-north-1",
"resources": [],
"detail": {
"eventVersion": "1.09",
"userIdentity": {
"type": "IAMUser",
"principalId": "ABCDEFGHIJKLMNOPQRSTU",
"arn": "arn:aws:iam::1234567890:user/user@example.com",
"accountId": "1234567890",
"userName": "user@example.com"
},
"eventTime": "2025-01-31T14:03:15Z",
"eventSource": "signin.amazonaws.com",
"eventName": "ConsoleLogin",
"awsRegion": "eu-north-1",
"sourceIPAddress": "193.0.0.0.1",
"userAgent": "Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0",
"requestParameters": null,
"responseElements": {
"ConsoleLogin": "Success"
},
"additionalEventData": {
"LoginTo": "https://console.aws.amazon.com/console/home",
"MobileVersion": "No",
"MFAIdentifier": "arn:aws:iam::1234567890:u2f/user/user@example.com/user-omg-my-yubikey",
"MFAUsed": "Yes"
},
"eventID": "000000-1539-4d7f-b6cc-000000000",
"readOnly": false,
"eventType": "AwsConsoleSignIn",
"managementEvent": true,
"recipientAccountId": "1234567890",
"eventCategory": "Management",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "eu-north-1.signin.aws.amazon.com"
}
}
}
"""
sns_signin_failure = """
{
"version": "0",
"id": "0000-a6cf-b920-6e14-000000",
"detail-type": "AWS Console Sign In via CloudTrail",
"source": "aws.signin",
"account": "1234567890",
"time": "2025-01-31T14:01:49Z",
"region": "eu-north-1",
"resources": [],
"detail": {
"eventVersion": "1.09",
"userIdentity": {
"type": "IAMUser",
"principalId": "AIDARWPFIVFS76W7ZBVBO",
"accountId": "1234567890",
"accessKeyId": "",
"userName": "user@example.com"
},
"eventTime": "2025-01-31T14:01:49Z",
"eventSource": "signin.amazonaws.com",
"eventName": "ConsoleLogin",
"awsRegion": "eu-north-1",
"sourceIPAddress": "193.0.0.0.1",
"userAgent": "Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0",
"errorMessage": "Failed authentication",
"requestParameters": null,
"responseElements": {
"ConsoleLogin": "Failure"
},
"additionalEventData": {
"LoginTo": "https://console.aws.amazon.com/console/home?",
"MobileVersion": "No",
"MFAUsed": "Yes"
},
"eventID": "00000-572b-4006-8d9f-00000",
"readOnly": false,
"eventType": "AwsConsoleSignIn",
"managementEvent": true,
"recipientAccountId": "1234567890",
"eventCategory": "Management",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "eu-north-1.signin.aws.amazon.com"
}
}
}
"""
async def test_aws_sns_notification() -> None:
r = await aws.parse_sns_event(None, json.loads(sns_notification), None)
@ -67,3 +167,17 @@ async def test_aws_sns_unsubscribe() -> None:
print(r)
expected = "You have chosen to deactivate subscription arn:aws:sns:us-west-2:123456789012:MyTopic:2bcfbf39-05c3-41de-beaa-fcfcc21c8f55.\nTo cancel this operation and restore the subscription, visit the SubscribeURL included in this message.\n\nhttps://sns.us-west-2.amazonaws.com/?Action=ConfirmSubscription&TopicArn=arn:aws:sns:us-west-2:123456789012:MyTopic&Token=2336412f37fb6..."
assert r[0] == (expected, expected)
async def test_aws_sns_signin() -> None:
r = await aws.parse_sns_event(None, json.loads(sns_signin), None)
print(r)
expected = "<font color=#dc3545>**🚨 ALERT[AwsConsoleSignIn]** </font>: AWS Console Sign detected by user `user@example.com`.<br/>- **Region**: eu-north-1<br/>- **MFA Used**: Yes<br/>- **Event Time**: 2025-01-31T14:03:15Z<br/>- **Account ID**: 1234567890"
assert r[0][1] == expected
async def test_aws_sns_signin_failure() -> None:
r = await aws.parse_sns_event(None, json.loads(sns_signin_failure), None)
print(r)
expected = "<font color=#ffc107>**🚨 ALERT[AwsConsoleSignIn]** </font>: Failed AWS Console Sign attempt by user `user@example.com`.<br/>- **Region**: eu-north-1<br/>- **MFA Used**: Yes<br/>- **Error Message**: Failed authentication<br/>- **Event Time**: 2025-01-31T14:01:49Z<br/>- **Account ID**: 1234567890"
assert r[0][1] == expected