Importing reports via AWS Lambda Function within AWS Security Hub

To send scanning data to AWS Security Hub on Appsec Portal

This is achieved using an AWS Lambda function written in Python. The function extracts an API key from AWS Secrets Manager, constructs a request with scanning data, and sends it to the specified Appsec Portal address.

Step 1: Integration Preparation

1. AWS Lambda: Ensure you have a configured and functioning AWS Lambda function

2. AWS Secrets Manager: Create a secret in AWS Secrets Manager containing the API key for accessing Appsec Portal. Ensure you have read access rights to this secret

Step 2: Creating AWS Lambda Function

1. Navigate to the AWS Lambda console

2. Create a new Lambda function according to your requirements

3. Make sure the function has the necessary permissions to access Secrets Manager and make HTTP requests

4. Insert the code into the code editor of your function:

import json
import boto3
import urllib.request
import urllib3


def lambda_handler(event, context):
    
    # Fetch Appsec Portal API key from AWS Secrets Manager
    client_sm = boto3.client('secretsmanager')
    appsec_portal_secret_raw = client_sm.get_secret_value(
        SecretId="<secret_name>"
    )
    appsec_portal_api_json = json.loads(appsec_portal_secret_raw["SecretString"])
    appsec_portal_api_token = "Token " + appsec_portal_api_json['key']
    
    while True:
        try:
            url = 'https://<portal_address>/api/v1/scan/import/'
            body = {
                "file": ("event.json", json.dumps(event)),
                "product_name": "AWS",
                "product_type": "AWS",
                "scanner_name": "AWS Security Hub Scan"
            }
            data, header = urllib3.encode_multipart_formdata(body)
            r = urllib.request.Request(url, data=data)
            r.add_header('Authorization', appsec_portal_api_token)
            r.add_header('Content-Type', header)
            response = urllib.request.urlopen(r)
            print(response.getcode())
        except Exception as e:
            raise e
        break
    return {
        'statusCode': 200,
        'body': json.dumps('Hello from Lambda!')
    }

Replace "<secret_name>" with the name of the secret in AWS Secrets Manager containing your API key for Appsec Portal

Replace "<portal_address>" with the address of your Appsec Portal

1. Save the changes made to the function

Step 3: Running the Function

1. In the "Test" section of the AWS Lambda console, create a test event with content similar to your report to test the function

2. If the function passes testing successfully, publish it

Congratulations! Your function is now ready to send reports to Appsec Portal