how to get an instance's security group from a Security Hub finding

Security Hub findings don't actually include security group information directly. But don't worry, you can still get what you need with a few tweaks to your Lambda function. Here's how you'll approach it:

First, you'll grab the EC2 instance ID from each Security Hub finding. Then, you'll use that ID to query the EC2 service and fetch the security group details.

To make this work, you'll need to add the ec2:DescribeInstances permission to your Lambda's IAM role. This lets your function talk to EC2 and get the instance details you need.

Now, let's modify your existing Lambda function. You'll keep the core of what you have and add some new bits:

import boto3

sns = boto3.client('sns')
securityhub = boto3.client('securityhub')
ec2 = boto3.client('ec2')  # New EC2 client

def get_security_groups(instance_id):
    try:
        response = ec2.describe_instances(InstanceIds=[instance_id])
        if response['Reservations']:
            instance = response['Reservations'][0]['Instances'][0]
            security_groups = instance.get('SecurityGroups', [])
            return ', '.join([sg['GroupName'] for sg in security_groups])
    except Exception as e:
        print(f"Couldn't get security groups for {instance_id}: {str(e)}")
    return "N/A"

def lambda_handler(event, context):
    # Your existing code to get findings...

    if not findings:
        message = "No active CRITICAL or HIGH severity findings."
    else:
        note = "Security Hub controls reference: https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-controls-reference.html\n\n"
        message = ""
        for f in findings:
            if f['Resources'] and 'Severity' in f and 'Title' in f and 'Description' in f:
                instance_details = f['Resources'][0].get('Details', {}).get('AwsEc2Instance', {})
                instance_id = instance_details.get('InstanceId', 'N/A')
                key_name = instance_details.get('KeyName', 'N/A')
                security_groups = get_security_groups(instance_id) if instance_id != 'N/A' else 'N/A'
                
                message += f"{key_name}: {f['Severity']['Label']}\n"
                message += f"Instance ID: {instance_id}\n"
                message += f"Security Groups: {security_groups}\n"
                message += f"{f['Title']}: {f['Description']}\n"
                message += f"Remediation: {f['Remediation']['Recommendation']['Text']}\n"
                message += f"Remediation URL: {f['Remediation']['Recommendation']['Url']}\n\n"

    # Your existing code to publish to SNS...

A couple of things to keep in mind:

This might make your Lambda run a bit longer because of the extra EC2 API calls. Some instances in the findings might not exist anymore, so I've added some error handling. If you're processing a ton of findings, you might want to consider batching or pagination to avoid timeouts.