Accessing security group from another account (Lambda, Python)

Question

I'm trying to write one lambda that automatically revokes ingress rules for '0.0.0.0/0' across all our AWS accounts. For the account the lambda exists in, it's pretty simple. The issue arises when I try to revoke ingress on a security group from another account. No combination of GroupId, SourceSecurityGroupOwnerId, Filter[{'Name': 'owner-id', 'Values': 'account#'}] and otherwise seems to work, I'm constantly hit with "That group doesn't exist". It's like the command doesn't look at the account I tell it to. Has anyone had experience with this?

Here's what I have so far (please ignore commented out lines, I'm still experimenting):

import json
import boto3

ec2 = boto3.client('ec2')
ec2_resources = boto3.resource('ec2')

def lambda_handler(event, context):
    ipPermissions = event['detail']['requestParameters']['ipPermissions']['items'][0]
    fromPort = ipPermissions['fromPort']
    ipProtocol = ipPermissions['ipProtocol']
    toPort = ipPermissions['toPort']
    IpPermissions = [{'FromPort': fromPort, 'IpProtocol': ipProtocol, 'IpRanges': [{'CidrIp': '0.0.0.0/0'}], 'Ipv6Ranges': [{'CidrIpv6': '::/0'}], 'PrefixListIds': [], 'ToPort': toPort, 'UserIdGroupPairs': []}]
    account = event['detail']['userIdentity']['accountId']
    groupId = event['detail']['requestParameters']['groupId']
    print(account)
    #response = ec2.revoke_security_group_ingress(GroupId=groupId,SourceSecurityGroupOwnerId=account)
    response = ec2.revoke_security_group_ingress(GroupId=groupId,IpPermissions=IpPermissions,SourceSecurityGroupOwnerId=account)
    #response = ec2.revoke_security_group_ingress(GroupId=groupId,CidrIp='0.0.0.0/0',SourceSecurityGroupOwnerId=security_group.owner_id)
    #print(response)
    print(json.dumps(event))
    return {
        'statusCode': 200,
        'body': json.dumps('Ingress revoked')
    }

Can you give an example of the lambda?

A. Abramov
– A. Abramov

2020-03-31 15:26:38 +00:00
Commented Mar 31, 2020 at 15:26 — A. Abramov
– A. Abramov, Commented Mar 31, 2020 at 15:26
Added to original post @a-abramov

basilbub
– basilbub

2020-03-31 16:01:18 +00:00
Commented Mar 31, 2020 at 16:01 — basilbub
– basilbub, Commented Mar 31, 2020 at 16:01

basilbub · Accepted Answer · 2020-04-01 00:09:49Z

1

Figured it out, you need to access the account using creds:

app_dev=sts_client.assume_role(RoleArn="arn:aws:iam::123456789012:role/SecurityGroupMonitor", RoleSessionName="AssumeRole")
ACCESS_KEY = app_dev['Credentials']['AccessKeyId']
SECRET_KEY = app_dev['Credentials']['SecretAccessKey']
SESSION_TOKEN = app_dev['Credentials']['SessionToken']
ec2_client = boto3.client('ec2', aws_access_key_id=ACCESS_KEY, aws_secret_access_key=SECRET_KEY, aws_session_token=SESSION_TOKEN)

answered Apr 1, 2020 at 0:09

basilbub

214 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Accessing security group from another account (Lambda, Python)

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related