Security Hub のメール通知を読みやすいように整形してみる（2025年版 & 日本語表記）

{
  "version": "0",
  "id": "0f74f373-6a5c-f1ac-effa-6db1d597c000",
  "detail-type": "Security Hub Findings - Imported",
  "source": "aws.securityhub",
  "account": "123456789012",
  "time": "2023-05-15T14:30:00Z",
  "region": "ap-northeast-1",
  "resources": [
    "arn:aws:securityhub:ap-northeast-1::product/aws/securityhub/arn:aws:securityhub:ap-northeast-1:123456789012:security-control/EC2.18/finding/abcdef12-3456-7890-abcd-ef1234567890"
  ],
  "detail": {
    "findings": [
      {
        "ProductArn": "arn:aws:securityhub:ap-northeast-1::product/aws/securityhub",
        "Types": [
          "Software and Configuration Checks/Industry and Regulatory Standards"
        ],
        "Description": "This control checks whether an Amazon EC2 security group permits unrestricted incoming traffic from unauthorized ports. The control status is determined as follows: If you use the default value for 'authorizedTcpPorts', the control fails if the security group permits unrestricted incoming traffic from any port other than ports 80 and 443; If you provide custom values for 'authorizedTcpPorts' or 'authorizedUdpPorts', the control fails if the security group permits unrestricted incoming traffic from any unlisted port; If no parameter is used, the control fails for any security group that has an unrestricted inbound traffic rule.",
        "Compliance": {
          "Status": "FAILED",
          "SecurityControlId": "EC2.18",
          "AssociatedStandards": [
            {
              "StandardsId": "standards/aws-foundational-security-best-practices/v/1.0.0"
            }
          ],
          "SecurityControlParameters": [
            {
              "Value": [],
              "Name": "authorizedUdpPorts"
            },
            {
              "Value": [
                "80",
                "443"
              ],
              "Name": "authorizedTcpPorts"
            }
          ]
        },
        "ProductName": "Security Hub",
        "FirstObservedAt": "2023-05-15T14:25:00.000Z",
        "CreatedAt": "2023-05-15T14:26:00.000Z",
        "LastObservedAt": "2023-05-15T14:25:00.000Z",
        "CompanyName": "AWS",
        "FindingProviderFields": {
          "Types": [
            "Software and Configuration Checks/Industry and Regulatory Standards"
          ],
          "Severity": {
            "Normalized": 70,
            "Label": "HIGH",
            "Original": "HIGH"
          }
        },
        "ProductFields": {
          "RelatedAWSResources:0/name": "securityhub-vpc-sg-open-only-to-authorized-ports-123abc45",
          "RelatedAWSResources:0/type": "AWS::Config::ConfigRule",
          "aws/securityhub/ProductName": "Security Hub",
          "aws/securityhub/CompanyName": "AWS",
          "aws/securityhub/annotation": "No tcp ['22'] port is authorized to be open, according to authorizedTcpPorts values ['80,443'] parameter.",
          "Resources:0/Id": "arn:aws:ec2:ap-northeast-1:123456789012:security-group/sg-abc123def456",
          "aws/securityhub/FindingId": "arn:aws:securityhub:ap-northeast-1::product/aws/securityhub/arn:aws:securityhub:ap-northeast-1:123456789012:security-control/EC2.18/finding/abcdef12-3456-7890-abcd-ef1234567890"
        },
        "Remediation": {
          "Recommendation": {
            "Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.",
            "Url": "https://docs.aws.amazon.com/console/securityhub/EC2.18/remediation"
          }
        },
        "SchemaVersion": "2018-10-08",
        "GeneratorId": "security-control/EC2.18",
        "RecordState": "ACTIVE",
        "Title": "Security groups should only allow unrestricted incoming traffic for authorized ports",
        "Workflow": {
          "Status": "NEW"
        },
        "Severity": {
          "Normalized": 70,
          "Label": "HIGH",
          "Original": "HIGH"
        },
        "UpdatedAt": "2023-05-15T14:26:00.000Z",
        "WorkflowState": "NEW",
        "AwsAccountName": "Example Account",
        "AwsAccountId": "123456789012",
        "Region": "ap-northeast-1",
        "Id": "arn:aws:securityhub:ap-northeast-1:123456789012:security-control/EC2.18/finding/abcdef12-3456-7890-abcd-ef1234567890",
        "Resources": [
          {
            "Partition": "aws",
            "Type": "AwsEc2SecurityGroup",
            "Details": {
              "AwsEc2SecurityGroup": {
                "GroupName": "test-security-group",
                "OwnerId": "123456789012",
                "VpcId": "vpc-abc12345",
                "IpPermissions": [
                  {
                    "FromPort": 22,
                    "ToPort": 22,
                    "IpProtocol": "tcp",
                    "IpRanges": [
                      {
                        "CidrIp": "0.0.0.0/0"
                      }
                    ]
                  }
                ],
                "IpPermissionsEgress": [
                  {
                    "IpProtocol": "-1",
                    "IpRanges": [
                      {
                        "CidrIp": "0.0.0.0/0"
                      }
                    ]
                  }
                ],
                "GroupId": "sg-abc123def456"
              }
            },
            "Region": "ap-northeast-1",
            "Id": "arn:aws:ec2:ap-northeast-1:123456789012:security-group/sg-abc123def456"
          }
        ],
        "ProcessedAt": "2023-05-15T14:29:00.000Z"
      }
    ]
  }
}