trek10inc / config-excess-access-exorcism Goto Github PK

Hello,

First of all Strong Work on this. It really fits my needs.

When attempting to deploy with

rdk -r us-east-1 deploy IAM_ALLOWS_UNUSED_SERVICES

I got this:

Running deploy!
Found Custom Rule.
Zipping IAM_ALLOWS_UNUSED_SERVICES
Uploading IAM_ALLOWS_UNUSED_SERVICES
Traceback (most recent call last):
File "/usr/local/bin/rdk", line 20, in
return_val = my_rdk.process_command()
File "/usr/local/lib/python2.7/dist-packages/rdk/rdk.py", line 227, in process_command
exit_code = method_to_call()
File "/usr/local/lib/python2.7/dist-packages/rdk/rdk.py", line 904, in deploy
s3_dst = self.__upload_function_code(rule_name, rule_params, account_id, my_session, code_bucket_name)
File "/usr/local/lib/python2.7/dist-packages/rdk/rdk.py", line 2029, in __upload_function_code
my_s3.meta.client.upload_file(s3_src, code_bucket_name, s3_dst)
File "/usr/local/lib/python2.7/dist-packages/boto3/s3/inject.py", line 131, in upload_file
extra_args=ExtraArgs, callback=Callback)
File "/usr/local/lib/python2.7/dist-packages/boto3/s3/transfer.py", line 287, in upload_file
filename, '/'.join([bucket, key]), e))

boto3.exceptions.S3UploadFailedError: Failed to upload /home/me/Gits/config-excess-access-exorcism/IAM_ALLOWS_UNUSED_SERVICES/IAM_ALLOWS_UNUSED_SERVICES.zip to config-rule-code-bucket-xxxxxxxxxxxx-us-east-2/IAM_ALLOWS_UNUSED_SERVICES/IAM_ALLOWS_UNUSED_SERVICES.zip: An error occurred (NoSuchBucket) when calling the CreateMultipartUpload operation: The specified bucket does not exist

After manually creating the bucket the deploy works. The role I assumed to run the command has permissions to create a bucket in the account

After deploying, the Lambda generated errors. I'm sorry I did not save any of the errors but they all refereed to the module 'redo' not being present.

I reran the following command appending it with redo:

pip install -t IAM_ALLOWS_UNUSED_SERVICES/ boto3 pytz redo

When I redeployed it worked.

This is really strong work. I have a suggestion to make the results cleaner. I'd like to have the ability to tag an IAM resource so that it is not evaluated for compliance. There are resources that we KNOW will be non-compliant and that we don't want to see in the list.