trendmicro / cloudone-filestorage-deployment-templates Goto Github PK

when cfn-nag is ran against the template aws/FSS-Scanner-Stack.template this error occurs:

| FAIL FATAL
|
| (): found unexpected ':' while scanning a plain scalar at line 228 column 69

Failures count: 1

This happens on all AWS pseudo parameters that are used. They need to be in double quotes for cfn-nag to not report a failure. This is important because we are trying to deploy this through Control Tower customizations to member accounts and it runs through a cfn-nag validation before it deploys. We've had to modify these pseudo parameters to pass the scan:

!Ref AWS::NoValue
!Ref AWS::StackId

I want to use the SNS filter policy to send an email when the scanner finds malware.
https://docs.amazonaws.cn/en_us/sns/latest/dg/sns-subscription-filter-policies.html

Is it possible to add some MessageAttributes when publishing to SNS, which is used by the lambda function to tag s3 buckets?

examples:

   "MessageAttributes": {
      "scanner_status": {
         "Type": "Number",
         "Value": 0
      },
      "malware_count": {
         "Type": "Number",
         "Value": 1
      },
      "bucket_name": {
         "Type": "String",
         "Value":"s3://bucket_url"
      }
   }

I checked aws-python-email-notification, but this script needs to activate AWS SES and Lambda.
https://github.com/trendmicro/cloudone-filestorage-plugins/tree/master/post-scan-actions/aws-python-email-notification

When cfn-lint is ran against the template aws/FSS-Scanner-Stack.template this error occurs:

E2507 IAM Resource Policy statement should have Principal or NotPrincipal

This is the resource with the issue, the principal is set to NoValue. Everything appears to work ok, but I think the policy still needs to be adjusted somehow to pass this check:

ScannerQueuePolicy:
Type: AWS::SQS::QueuePolicy
Properties:
PolicyDocument:
Version: 2012-10-17
Statement:
- Sid: send_message_from_accounts
Effect: Allow
Principal: !Ref AWS::NoValue
Action:
- sqs:SendMessage
Resource: !GetAtt ScannerQueue.Arn
Queues:
- !Ref ScannerQueue

I've used those ARM templates to create Terraform manifests for both scanner and storage stacks.
After creating scanner resources, when I try to add the scanner to TM FSS Portal, I get this error:

{
"stackID": "***",
"status": "creation-failed",
"statusDetail": "failed to retrieve scanner stack",
"details": {}
}