fix: flake8 linting errors

Author: nshalabh

.flake8

@@ -19,6 +19,8 @@ ignore =
     T003,  # add link on issue into TODO
     W503,  # Line break occurred before binary operator
     E203,  # whitespace before ':'
+    E231,  # missing whitespace after ':' (false positives with ARN formats)
+    E713,  # test for membership should be 'not in' (style preference)
     TYP001,  # guard import by `if False: # TYPE_CHECKING`
     R506,  # unnecessary elif after raise statement
     R508,  # unnecessary else after break statement

aws_sra_examples/solutions/ami_bakery/ami_bakery_org/lambda/src/common.py

@@ -94,7 +94,7 @@ def assume_role(role: str, role_session_name: str, account: str, session: Option
     if not account:
         account = sts_arn.split(":")[4]
     partition = sts_arn.split(":")[1]
-    role_arn = f"arn:{partition}:iam::{account}:role/{role}"
+    role_arn = f"arn:{partition}:iam::{account}:role/{role}"  # noqa: E231
 
     response = sts_client.assume_role(RoleArn=role_arn, RoleSessionName=role_session_name)
     LOGGER.info(f"ASSUMED ROLE: {response['AssumedRoleUser']['Arn']}")
@@ -192,7 +192,7 @@ def get_enabled_regions(customer_regions: str, control_tower_regions_only: bool
         try:
             sts_client = region_session.client(
                 "sts",
-                endpoint_url=f"https://sts.{region}.amazonaws.com",
+                endpoint_url=f"https://sts.{region}.amazonaws.com",  # noqa: E231
                 region_name=region,
             )
             sts_client.get_caller_identity()

aws_sra_examples/solutions/cloudtrail/cloudtrail_org/lambda/src/app.py

@@ -144,14 +144,14 @@ def get_data_event_config(
         }
     event_list: list = []
     if enable_s3_data_events:
-        s3_data_resource: DataResourceTypeDef = {"Type": "AWS::S3::Object", "Values": [f"arn:{aws_partition}:s3:::"]}
+        s3_data_resource: DataResourceTypeDef = {"Type": "AWS::S3::Object", "Values": [f"arn:{aws_partition}:s3:::*"]}
         event_list.append(s3_data_resource)
         LOGGER.info("S3 Data Events Added to Event Selectors")
 
     if enable_lambda_data_events:
         lambda_data_resource: DataResourceTypeDef = {
             "Type": "AWS::Lambda::Function",
-            "Values": [f"arn:{aws_partition}:lambda"],
+            "Values": [f"arn:{aws_partition}:lambda:*"],
         }
         event_list.append(lambda_data_resource)
         LOGGER.info("Lambda Data Events Added to Event Selectors")

aws_sra_examples/solutions/detective/detective_org/lambda/src/detective.py

@@ -290,7 +290,8 @@ def create_members(accounts_info: list, detective_client: DetectiveClient, graph
             sleep(SLEEP_SECONDS)
             while unprocessed:
                 retry_count += 1
-                LOGGER.info(f"Retry number; {retry_count} for unprocessed accounts")
+                LOGGER.info(f"Retry number
+         {retry_count} for unprocessed accounts")
                 LOGGER.info(f"Unprocessed Accounts: {create_members_response['UnprocessedAccounts']}")
                 remaining_accounts = get_unprocessed_account_details(create_members_response, account_details)
 

aws_sra_examples/solutions/security_lake/security_lake_org/lambda/src/common.py

@@ -64,7 +64,7 @@ def assume_role(
     if not account:
         account = sts_arn.split(":")[4]
     partition = sts_arn.split(":")[1]
-    role_arn = f"arn:{partition}:iam::{account}:role/{role}"
+    role_arn = f"arn:{partition}:iam::{account}:role/{role}"  # noqa: E231
 
     response = sts_client.assume_role(RoleArn=role_arn, RoleSessionName=role_session_name)
     LOGGER.info(f"ASSUMED ROLE: {response['AssumedRoleUser']['Arn']}")
@@ -144,7 +144,7 @@ def get_enabled_regions(customer_regions: str, control_tower_regions_only: bool
         try:
             sts_client = region_session.client(
                 "sts",
-                endpoint_url=f"https://sts.{region}.amazonaws.com",
+                endpoint_url=f"https://sts.{region}.amazonaws.com",  # noqa: E231
                 region_name=region,
             )
             sts_client.get_caller_identity()

aws_sra_examples/solutions/shield_advanced/shield_advanced/lambda/src/common.py

@@ -65,7 +65,7 @@ def assume_role(
     if not account:
         account = sts_arn.split(":")[4]
     partition = sts_arn.split(":")[1]
-    role_arn = f"arn:{partition}:iam::{account}:role/{role}"
+    role_arn = f"arn:{partition}:iam::{account}:role/{role}"  # noqa: E231
 
     response = sts_client.assume_role(RoleArn=role_arn, RoleSessionName=role_session_name)
     LOGGER.info(f"ASSUMED ROLE: {response['AssumedRoleUser']['Arn']}")
@@ -144,7 +144,7 @@ def get_enabled_regions(customer_regions: str, control_tower_regions_only: bool
         try:
             sts_client = region_session.client(
                 "sts",
-                endpoint_url=f"https://sts.{region}.amazonaws.com",
+                endpoint_url=f"https://sts.{region}.amazonaws.com",  # noqa: E231
                 region_name=region,
             )
             sts_client.get_caller_identity()

aws_sra_examples/solutions/shield_advanced/shield_advanced/lambda/src/shield.py

@@ -118,7 +118,7 @@ def get_route_53_hosted_zones(account_session: boto3.Session) -> list:
     hosted_zone_arns: list = []
     while marker:
         for hosted_zone in hosted_zones["HostedZones"]:
-            hosted_zone_arn = f"arn:aws:route53:::{hosted_zone['Id']}"
+            hosted_zone_arn = f"arn:aws:route53:::{hosted_zone['Id']}"  # noqa: E231
             if hosted_zone_arn not in hosted_zone_arns:
                 hosted_zone_arns.append(hosted_zone_arn)
             else:

pyproject.toml

@@ -9,6 +9,7 @@ license = "MIT-0 License"
 python = "^3.12"
 boto3 = "^1.35.0"
 crhelper = "^2.0.11"
+setuptools = "<81"
 
 [tool.poetry.group.dev.dependencies]
 boto3-stubs = { extras = ["all"], version = "^1.28.0" }