In an ever-changing security landscape, teams must be able to quickly remediate security risks. Many organizations look for ways to automate the remediation of security findings that are currently handled manually. Amazon CodeWhisperer is an artificial intelligence (AI) coding companion that generates real-time, single-line or full-function code suggestions in your integrated development environment (IDE) to help you quickly build software. By using CodeWhisperer, security teams can expedite the process of writing security automation scripts for various types of findings that are aggregated in AWS Security Hub, a cloud security posture management (CSPM) service.

   <p>In this post, we present some of the current challenges with security automation and walk you through how to use CodeWhisperer, together with <a href="https://aws.amazon.com/eventbridge/" target="_blank" rel="noopener">Amazon EventBridge</a> and <a href="https://aws.amazon.com/lambda/" target="_blank" rel="noopener">AWS Lambda</a>, to automate the remediation of Security Hub findings. Before reading further, please read the <a href="https://aws.amazon.com/machine-learning/responsible-ai/policy/" target="_blank" rel="noopener">AWS Responsible AI Policy.</a></p> 
   <h2>Current challenges with security automation</h2> 
   <p>Many approaches to security automation, including Lambda and <a href="https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-automation.html" target="_blank" rel="noopener">AWS Systems Manager Automation</a>, require software development skills. Furthermore, the process of manually writing code for remediation can be a time-consuming process for security professionals. To help overcome these challenges, CodeWhisperer serves as a force multiplier for qualified security professionals with development experience to quickly and effectively generate code to help remediate security findings.</p> 
   <p>Security professionals should still cultivate software development skills to implement robust solutions. Engineers should thoroughly review and validate any generated code, as manual oversight remains critical for security. </p> 
   <h2>Solution overview</h2> 
   <p>Figure 1 shows how the findings that <a href="https://aws.amazon.com/security-hub/" target="_blank" rel="noopener">Security Hub</a> produces are ingested by <a href="https://aws.amazon.com/eventbridge/" target="_blank" rel="noopener">EventBridge</a>, which then invokes <a href="https://aws.amazon.com/lambda/" target="_blank" rel="noopener">Lambda</a> functions for processing. The Lambda code is generated with the help of <a href="https://aws.amazon.com/codewhisperer/" target="_blank" rel="noopener">CodeWhisperer</a>.</p> 
   <div id="attachment_33896" class="wp-caption aligncenter"> 
    <img aria-describedby="caption-attachment-33896" src="https://infracom.com.sg/wp-content/uploads/2024/04/img1-2-1.png" alt width="780" class="size-full wp-image-33896"> 
    <p id="caption-attachment-33896" class="wp-caption-text">Figure 1: Diagram of the solution</p> 
   </div> 
   <p>Security Hub integrates with EventBridge so you can automatically process findings with other services such as Lambda. To begin remediating the findings automatically, you can configure rules to determine where to send findings. This solution will do the following:</p> 
   <ol> 
    <li>Ingest an Amazon Security Hub finding into EventBridge.</li> 
    <li>Use an EventBridge rule to invoke a <a href="https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChcSEwj2oNnqqfr_AhWQq8gKHYJjAoYYABAAGgJxdQ&ase=2&ohost=www.google.com&cid=CAESauD2Z2WXlYvMUHVV368VhQ79uK6uow20GUKwE1cFQjxZI0acYkWln_c3azrvTHiNwCErviGlLT4vUS_GdBfCYgr23wBzXJILcpkAn4QYlPtUdkkpThnRbdmnFu4QZEUkANPxHTYjj5mBjmY&sig=AOD64_3pZRsOiUxICSPEBp-66xwnh_XA8g&q&nis=4&adurl&ved=2ahUKEwjHzdHqqfr_AhUTVDUKHbeOC4QQ0Qx6BAgJEAE" target="_blank" rel="noopener">Lambda function</a> for processing. </li> 
    <li>Use CodeWhisperer to generate the Lambda function code.</li> 
   </ol> 
   <p>It is important to note that there are two types of automation for Security Hub finding remediation:</p> 
   <ul> 
    <li><strong>Partial automation</strong>, which is initiated when a human worker selects the Security Hub findings manually and applies the automated remediation workflow to the selected findings.</li> 
    <li><strong>End-to-end automation</strong>, which means that when a finding is generated within Security Hub, this initiates an automated workflow to immediately remediate without human intervention.</li> 
   </ul> 
   <blockquote> 
    <p><strong>Important:</strong> When you use end-to-end automation, we highly recommend that you thoroughly test the efficiency and impact of the workflow in a non-production environment first before moving forward with implementation in a production environment.</p> 
   </blockquote> 
   <h2>Prerequisites </h2> 
   <p>To follow along with this walkthrough, make sure that you have the following prerequisites in place:</p> 

   <h2>Implement security automation</h2> 
   <p>In this scenario, you have been tasked with making sure that versioning is enabled across all <a href="https://aws.amazon.com/s3/" target="_blank" rel="noopener">Amazon Simple Storage Service (Amazon S3)</a> buckets in your AWS account. Additionally, you want to do this in a way that is programmatic and automated so that it can be reused in different AWS accounts in the future.</p> 
   <p>To do this, you will perform the following steps:</p> 
   <ol> 
    <li>Generate the remediation script with CodeWhisperer</li> 
    <li>Create the Lambda function</li> 
    <li>Integrate the Lambda function with Security Hub by using EventBridge</li> 
    <li>Create a custom action in Security Hub</li> 
    <li>Create an EventBridge rule to target the Lambda function</li> 
    <li>Run the remediation</li> 
   </ol> 
   <h3>Generate a remediation script with CodeWhisperer</h3> 
   <p>The first step is to use VS Code to create a script so that CodeWhisperer generates the code for your Lambda function in Python. You will use this Lambda function to remediate the Security Hub findings generated by the <a href="https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-8" target="_blank" rel="noopener"><strong>[S3.14] S3 buckets should use versioning</strong></a> control.</p> 
   <blockquote> 
    <p><strong>Note:</strong> The underlying model of CodeWhisperer is powered by generative AI, and the output of CodeWhisperer is nondeterministic. As such, the code recommended by the service can vary by user. By modifying the initial code comment to prompt CodeWhisperer for a response, customers can change the corresponding output to help meet their needs. Customers should subject all code generated by CodeWhisperer to typical testing and review protocols to verify that it is free of errors and is in line with applicable organizational security policies. To learn about best practices on prompt engineering with CodeWhisperer, <a href="https://aws.amazon.com/blogs/devops/best-practices-for-prompt-engineering-with-amazon-codewhisperer/" target="_blank" rel="noopener">see this AWS blog post</a>.</p> 
   </blockquote> 
   <h4>To generate the remediation script</h4> 
   <ol> 
    <li>Open a new VS Code window, and then open or create a new folder for your file to reside in.</li> 
    <li>Create a Python file called <span>cw-blog-remediation.py</span> as shown in Figure 2.<br>  
     <div id="attachment_33897" class="wp-caption aligncenter"> 
      <img aria-describedby="caption-attachment-33897" src="https://infracom.com.sg/wp-content/uploads/2024/04/img2-4.png" alt="Figure 2: New VS Code file created called cw-blog-remediation.py" width="740" class="size-full wp-image-33897"> 
      <p id="caption-attachment-33897" class="wp-caption-text">Figure 2: New VS Code file created called cw-blog-remediation.py</p> 
     </div> </li> 
    <li>Add the following imports to the Python file. 
     <div class="hide-language"> 
      <pre class="unlimited-height-code"><code class="lang-text"><span>import</span> json

import boto3

    <li>Because you have the context added to your file, you can now prompt CodeWhisperer by using a natural language comment. In your file, below the import statements, enter the following comment and then press <strong>Enter</strong>. 
     <div class="hide-language"> 
      <pre class="unlimited-height-code"><code># Create lambda function that turns on versioning for an S3 bucket after the function is triggered from Amazon EventBridge</code></pre> 
     </div> </li> 
    <li>Accept the first recommendation that CodeWhisperer provides by pressing <strong>Tab</strong> to use the Lambda function handler, as shown in Figure 3.<br />&amp;ngsp; 
     <div id="attachment_33899" class="wp-caption aligncenter"> 
      <img aria-describedby="caption-attachment-33899" src="https://infracom.com.sg/wp-content/uploads/2024/04/img3-4.png" alt="Figure 3: Generation of Lambda handler" width="740" class="size-full wp-image-33899" /> 
      <p id="caption-attachment-33899" class="wp-caption-text">Figure 3: Generation of Lambda handler</p> 
     </div> </li> 
    <li>To get the recommendation for the function from CodeWhisperer, press <strong>Enter</strong>. Make sure that the recommendation you receive looks similar to the following. CodeWhisperer is nondeterministic, so its recommendations can vary. 
     <div class="hide-language"> 
      <pre class="unlimited-height-code"><code class="lang-text"><span>import</span> json

import boto3

# Create lambda function that turns on versioning for an S3 bucket after function is triggered from Amazon EventBridge
def lambda_handler(event, context):
s3 = boto3.client(‘s3’)
bucket = event[‘detail’][‘requestParameters’][‘bucketName’]
response = s3.put_bucket_versioning(
Bucket=bucket,
VersioningConfiguration={
‘Status’: ‘Enabled’
}
)
print(response)
return {
‘statusCode’: 200,
‘body’: json.dumps(‘Versioning enabled for bucket ‘ + bucket)
}