AWS Security Hub Integration with Sentinel "Authentication Issue"

[Mandar16161]

Describe the bug
Deploying the AWS security hub gives a AAD authentication related issue when test run in the function app.

To Reproduce
Steps to reproduce the behavior:

1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error

Expected behavior
The steps are followed as mentioned in the document, the managed identity should have authenticated but its failing while runing.

Screenshots

Desktop (please complete the following information):

• OS: Windows 11
• Browser chrome
• Version [e.g. 22]

Smartphone (please complete the following information):

• Device: [e.g. iPhone6]
• OS: [e.g. iOS8.1]
• Browser [e.g. stock browser, safari]
• Version [e.g. 22]

Additional context
Add any other context about the problem here.

[v-rusraut]

Hi @Mandar16161,
We have been able to reproduce this issue and found that the error occurred due to an incorrect ClientID value. Please check the attached document to add the correct ClientID value in the function app configuration.

FunctionsAppConfiguration.docx
Please let us know if your issue has been resolved or not
Thanks

[v-rusraut]

Hi @Mandar16161,
We are waiting for your response.

[Mandar16161]

Hi @v-rusraut i am not able to access the document shared by you.

[v-rusraut]

Hi @Mandar16161,
Please refer below steps

• Open Azure portal and search ‘Microsoft Entra ID’

• Click on Enterprise applications

• Type your function app name in search textbox and copy Application ID

• Open function app -> Settings - > Environment variables - > App settings ->
Click on Client ID and paste application ID and click on Apply.

• After that restart the function app

[v-rusraut]

Hi @Mandar16161,
We are waiting for your response.

[Mandar16161]

Hi @v-rusraut,
I have provided the the solution you provided to the team waiting for their response ,will keep you posted.

[Mandar16161]

@v-rusraut please let me know did you provide any RBAC role the managed identity during the deployment?

[v-rusraut]

Hi @Mandar16161, not provided any role while deployment, what error you are getting now ?

[Mandar16161]

Same issue we had the client id in place already .

[Mandar16161]

this is the error

[Mandar16161]

[Mandar16161]

[rcscoggin]

We having same exact issue, ClientID is correct, have verified it multiple times.

[rcscoggin]

[Mandar16161]

Hi @rcscoggin at line no 75 add
credential = ManagedIdentityCredential( client_id=client_id) it should resolve the issue, also there are numerous other errors once you solve this one the code needs to be rechecked by the developer.

[v-rusraut]

Hi @Mandar16161, which new error you are getting now?

[Mandar16161]

Hi @v-rusraut
Last changes made on code Audience='https://sts.amazonaws.com/' on line number 155 of visual studio but not ran successfully.

[v-rusraut]

Hi @Mandar16161,
Please provide more details about the error.

[v-rusraut]

Hi @rcscoggin,
Please deploy the function app and share the invocation logs.

[rcscoggin]

@v-rusraut I don't have any changes in place nor do I see an update in the code on the repo, just the current branch. Would probably be better for @Mandar16161 to share his logs with his new error after fixing line 75 then another log after modifying 155.

[v-rusraut]

Hi @Mandar16161,
We are waiting for your response, please provide more details about the current error.

[Mandar16161]

Hi we have currently stopped the testing due to too many errors, we are co-ordinating with Microsoft Team to get a resolution on this.

[v-rusraut]

Hi @Mandar16161, as you mentioned you are coordinating with the Microsoft Team for this, can we close this issue, or do you still need support?

[rcscoggin]

Hi, end user here of the solution. We still have the original issue, we reached out to Microsoft and they said they do not support this code and to contact authors of the code for resolution. Would ask you not close issue as we would have to open another. We are still getting the original error that Mandar16161 is getting. thanks.

[v-rusraut]

Hi @rcscoggin, we received a response from @sreedharande indicating that the error you’re encountering is due to incorrect AWS side configuration. Please refer to the following section of the README file for AWS side configuration : https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/AWS-SecurityHubFindings/README.md#aws

[rcscoggin]

@v-rusraut right, we are not a new user of this and have deployed the connector over the past years many times. We have triple checked the AWS settings. What we are NOT seeing are any entries in the signin logs for the managed identity indicating the code never attempts to properly authenticate. We had troubleshooted to the same issue that the ManagedIdentityCredential call may be suspect.

Please, confirm on your side that the managed identity would have some entry in the signin logs for a failed attempt since that would happen BEFORE it would attempt to use the AWS api hence resulting in some evidence of the Azure authentication code having been able to at least attempt an authentication.

Thanks,
Rodger

[v-rusraut]

Hi @sreedharande , please help on this issue.

[Mandar16161]

Hi @v-rusraut we are still not able to resolve the issue, @sreedharande your support on this would be appreciated.