Manufacturing SecOps: AWS/Azure Compliance Audit Blueprint

import json
import os
import boto3
import requests
import logging

# --- Configuration --- 
SENTINEL_TENANT_ID = os.environ.get('SENTINEL_TENANT_ID') # Azure AD Tenant ID
SENTINEL_CLIENT_ID = os.environ.get('SENTINEL_CLIENT_ID') # Azure AD Application (client) ID
SENTINEL_CLIENT_SECRET = os.environ.get('SENTINEL_CLIENT_SECRET') # Azure AD Application key
SENTINEL_WORKSPACE_ID = os.environ.get('SENTINEL_WORKSPACE_ID') # Azure Sentinel Workspace ID

# --- Logging Setup --- 
logger = logging.getLogger()
logger.setLevel(logging.INFO)

# --- AWS Clients --- 
sts_client = boto3.client('sts')

# --- Helper Functions --- 
def get_sentinel_token(): 
    token_url = f'https://login.microsoftonline.com/{SENTINEL_TENANT_ID}/oauth2/v2.0/token'
    token_data = {
        'grant_type': 'client_credentials',
        'client_id': SENTINEL_CLIENT_ID,
        'client_secret': SENTINEL_CLIENT_SECRET,
        'scope': 'https://graph.microsoft.com/.default'
    }
    try:
        response = requests.post(token_url, data=token_data)
        response.raise_for_status() # Raise HTTPError for bad responses (4xx or 5xx)
        return response.json()['access_token']
    except requests.exceptions.RequestException as e:
        logger.error(f"Error obtaining Sentinel token: {e}")
        return None

def send_to_sentinel(token, data):
    ingestion_url = f'https://{SENTINEL_WORKSPACE_ID}.ods.opinsights.azure.com/api/logs?api-version=2016-04-01'
    headers = {
        'Content-Type': 'application/json',
        'Authorization': f'Bearer {token}'
    }
    try:
        response = requests.post(ingestion_url, headers=headers, data=json.dumps(data))
        response.raise_for_status()
        logger.info(f"Successfully sent {len(data)} records to Sentinel. Status: {response.status_code}")
    except requests.exceptions.RequestException as e:
        logger.error(f"Error sending data to Sentinel: {e}. Response: {response.text if response else 'No response'}")

# --- Lambda Handler --- 
def lambda_handler(event, context):
    logger.info(f"Received event: {json.dumps(event)}")

    # Get current AWS Account ID for context
    try:
        aws_account_id = sts_client.get_caller_identity().get('Account')
    except Exception as e:
        logger.error(f"Could not retrieve AWS Account ID: {e}")
        aws_account_id = 'unknown'

    sentinel_token = get_sentinel_token()
    if not sentinel_token:
        return {'statusCode': 500, 'body': json.dumps('Failed to get Sentinel token')}

    sentinel_payload = []
    
    # Process Security Hub findings from EventBridge event
    if 'detail' in event and 'findings' in event['detail']:
        findings = event['detail']['findings']
        for finding in findings:
            # Construct a custom log record for Sentinel
            log_record = {
                'AwsAccountID': aws_account_id,
                'SecurityHubFinding': finding,
                'TimeGenerated': finding.get('CreatedAt', finding.get('UpdatedAt')) # Use finding creation/update time
            }
            sentinel_payload.append(log_record)
            
    # If the event is from S3 (e.g., batch export), adjust processing logic
    elif 'Records' in event:
        s3 = boto3.client('s3')
        for record in event['Records']:
            bucket = record['s3']['bucket']['name']
            key = record['s3']['object']['key']
            try:
                obj = s3.get_object(Bucket=bucket, Key=key)
                file_content = obj['Body'].read().decode('utf-8')
                s3_findings = json.loads(file_content)
                
                # Assuming S3 export provides a list of findings or a structure containing them
                if isinstance(s3_findings, dict) and 'Findings' in s3_findings:
                    findings = s3_findings['Findings']
                elif isinstance(s3_findings, list):
                    findings = s3_findings
                else:
                    logger.warning(f"Unexpected JSON structure in S3 object {key}")
                    continue

                for finding in findings:
                    log_record = {
                        'AwsAccountID': aws_account_id,
                        'SecurityHubFinding': finding,
                        'TimeGenerated': finding.get('CreatedAt', finding.get('UpdatedAt'))
                    }
                    sentinel_payload.append(log_record)

            except Exception as e:
                logger.error(f"Error processing S3 object {key} from bucket {bucket}: {e}")

    else:
        logger.warning("Event structure not recognized. Expected Security Hub findings or S3 event.")
        return {'statusCode': 400, 'body': json.dumps('Unsupported event structure')}

    if not sentinel_payload:
        logger.info("No findings processed. Exiting.")
        return {'statusCode': 200, 'body': json.dumps('No findings to send')}

    # Send data to Sentinel
    # Sentinel expects logs in batches, max 1000 records per batch, max 1MB per batch
    # For simplicity, sending all collected records in one go. For large volumes, batching is required.
    send_to_sentinel(sentinel_token, sentinel_payload)

    return {
        'statusCode': 200,
        'body': json.dumps(f'Processed {len(sentinel_payload)} findings and sent to Sentinel.')
    }