Programmatically Mapping AWS Resource Types to AWS Services

Question

I would like to map AWS Resource Types to AWS Services programmatically when fetching AWS SecurityHub findings. For example, if an AWS SecurityHub finding indicates the affected resource with AwsS3Bucket, I would like to convert that to AWS S3 as this is the corresponding AWS Service. Does the AWS APIs offer such a conversion, I am working with Java.

Answer 1

There's no API for an automatic conversion. However, you can get all available resource types from the JSON document avaliable at AWS Security Finding Format (ASFF) documentation. All types can be found in Resources.Details (see JSON snippet below).

With this you can create a converter with an in-memory lookup list or a lookup table in DynamoDB to retrieve the respective service.

"Findings": [ 
    {
        ...
        "Resources": [{
            ...
            "Details": {
                "AwsAmazonMQBroker": { ... },
                "AwsApiGatewayRestApi": { ... },
                ...
            }
        }]
    }
]