Alternative for AWS Cli for Security Hub Upload

[computeralex92]

I want to extend my current setup of Trivy with the upload of the results to AWS Security Hub.
Unfortunately the only way I figure out to upload the results is the usage of AWS CLI (as documented also in the Trivy docs).

As the AWS CLI is Python based and quite big for "only" uploading the results, maybe someone of you have a good idea to upload it without the usage of the CLI tool?

[krol3]

Hi @computeralex92, could you elaborate more about the "big" uploading results. Is it related to use the command $ aws securityhub batch-import-findings --findings file://report.asff

[computeralex92]

Yep, that would be the normal way.
Unfornatelay using the AWS CLI have for me two major drawbacks:

• I need to store and get the report file from one pipeline step to the next (when using the trivy & awscli container image in seperate steps.
• As some of my results files are quite big (over 100 results), the AWS CLI is not able to handle it currectly (the API is limited to 100 results per call)

Of course I could add Trivy to the awscli container image and be happy (would be the easiest way), but with the issue of the 100 results limitation my current thinking goes in the direction to create a little go-based tool which takes the result file, split it (if needed) and uploaded it to AWS.

Mainly like the upload function in Kube-Bench...