aws-samples / aws-samples/aws-security-reference-architecture-examples
[FEATURE] Possibility to set pExcludeS3BlockAccountPublicAccessTags Parameter without using SRA in us-east-1
- Dominant language
- Python
- Stars
- 1.2k
- Forks
- 303
- Avg merge
- 3d 9h
- Merged PRs (30d)
- 1
Description
**Community Note**
- Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
- Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
- If you are interested in working on this issue or have submitted a pull request, please leave a comment
### Is your feature request related to a problem? Please describe
When tagging an account in Organizations, the CloudTrail event gets created in us-east-1 as Organizations is a global service. When using SRA in a region which is not us-east-1, the setting of the parameter pExcludeS3BlockAccountPublicAccessTags has no effect as the CloudTrail event just exists in us-east-1
### Describe the solution you'd like
Adjustment in the EventBridge trigger or somewhere else to execute the Lambda function which is f.e. located in eu-central-1 eventhough the event is created in us-east-1
Contributor guide
Research direction
Start by tracing the EventBridge trigger and the Lambda deployment used for pExcludeS3BlockAccountPublicAccessTags, focusing on how SRA regions handle the us-east-1 Organizations event. Done means the parameter works when the SRA deployment is outside us-east-1 and the relevant event is processed by the regional Lambda.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python
- Domain
- cloud, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100