fix(cloudtrail): fix path and extract more fields from the s3 notification event #412
Conversation
Signed-off-by: matteopasa <[email protected]>
Rules files suggestionsaws_cloudtrail_rules.yamlComparing No changes detected |
Signed-off-by: matteopasa <[email protected]>
matteopasa
force-pushed
the
pasa/cloudtrail/s3-notification-info
branch
from
ea96ca8 to
fc1abb7
Compare
matteopasa
changed the title
Rules files suggestionsaws_cloudtrail_rules.yamlComparing No changes detected |
Signed-off-by: matteopasa <[email protected]>
Rules files suggestionsaws_cloudtrail_rules.yamlComparing No changes detected |
|
/lgtm |
|
LGTM label has been added. Git tree hash: fd47aa5f42ff895b94247febf825fd2672d5915d
|
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: Issif, matteopasa The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
| if val == nil { | ||
| val = jdata.GetStringBytes("request-id") | ||
| } |
There was a problem hiding this comment.
This situation should never happen, eventID is a mandatory field. Moreover, it seems the path is requestID:
There was a problem hiding this comment.
the thing is that the s3 notification event that we are receiving is this one: https://docs.aws.amazon.com/AmazonS3/latest/userguide/ev-events.html
The part inside the "detail" field
I've tried to map some of the fields to the ct fields but I can remove them
There was a problem hiding this comment.
The plugin is from collecting the audit logs from cloudtrail, we should never receive a direct S3 event. Maybe I'm wrong or there's something I don't get.
There was a problem hiding this comment.
We want to extract fields also from s3 notification events, that is the reason of the change
The fields we are interested in are the s3 ones, so I can remove the ct ones if they can cause issues
What type of PR is this?
Any specific area of the project related to this PR?
What this PR does / why we need it:
Which issue(s) this PR fixes:
Fixes #
Special notes for your reviewer: