11
2+ """Config rule to check s3 endpoints for Bedrock environemts.
3+
4+ Version: 1.0
5+
6+ Config rule for SRA in the repo, https://github.com/aws-samples/aws-security-reference-architecture-examples
7+
8+ Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
9+ SPDX-License-Identifier: MIT-0
10+ """
211from typing import Any
312import boto3
413import json
1827ec2_client = boto3 .client ('ec2' , region_name = AWS_REGION )
1928config_client = boto3 .client ('config' , region_name = AWS_REGION )
2029
21- def evaluate_compliance (configuration_item : dict ) -> tuple [str , str ]:
22- """Evaluates if an S3 Gateway Endpoint is in place for the VPC"""
23-
30+
31+ def evaluate_compliance (configuration_item : dict ) -> tuple [str , str ]: # noqa: CFQ004
32+ """Evaluate if an S3 Gateway Endpoint is in place for the VPC.
33+
34+ Args:
35+ configuration_item (dict): The AWS Config rule configuration item.
36+
37+ Returns:
38+ tuple[str, str]: Compliance type and annotation message.
39+
40+ """
2441 if configuration_item ['resourceType' ] != 'AWS::EC2::VPC' :
2542 return 'NOT_APPLICABLE' , "Resource is not a VPC"
2643
2744 vpc_id = configuration_item ['configuration' ]['vpcId' ]
28-
45+
2946 try :
3047 response = ec2_client .describe_vpc_endpoints (
3148 Filters = [
@@ -38,14 +55,20 @@ def evaluate_compliance(configuration_item: dict) -> tuple[str, str]:
3855 if response ['VpcEndpoints' ]:
3956 endpoint_id = response ['VpcEndpoints' ][0 ]['VpcEndpointId' ]
4057 return 'COMPLIANT' , f"S3 Gateway Endpoint is in place for VPC { vpc_id } . Endpoint ID: { endpoint_id } "
41- else :
42- return 'NON_COMPLIANT' , f"S3 Gateway Endpoint is not in place for VPC { vpc_id } "
58+ return 'NON_COMPLIANT' , f"S3 Gateway Endpoint is not in place for VPC { vpc_id } "
4359
4460 except Exception as e :
4561 LOGGER .error (f"Error evaluating S3 Gateway Endpoint configuration: { str (e )} " )
4662 return 'ERROR' , f"Error evaluating compliance: { str (e )} "
4763
48- def lambda_handler (event : dict , context : Any ) -> None :
64+
65+ def lambda_handler (event : dict , context : Any ) -> None : # noqa: U100
66+ """Lambda handler.
67+
68+ Args:
69+ event (dict): Config event object
70+ context (Any): Lambda context object
71+ """
4972 LOGGER .info ('Evaluating compliance for AWS Config rule' )
5073 LOGGER .info (f"Event: { json .dumps (event )} " )
5174
@@ -88,4 +111,4 @@ def lambda_handler(event: dict, context: Any) -> None:
88111 ResultToken = event ['resultToken' ]
89112 )
90113
91- LOGGER .info (f"Compliance evaluation complete. Processed { len (evaluations )} evaluations." )
114+ LOGGER .info (f"Compliance evaluation complete. Processed { len (evaluations )} evaluations." )
0 commit comments