diff --git a/plugins/aws/fix_plugin_aws/resource/guardduty.py b/plugins/aws/fix_plugin_aws/resource/guardduty.py index 14b4e8949..2ea226773 100644 --- a/plugins/aws/fix_plugin_aws/resource/guardduty.py +++ b/plugins/aws/fix_plugin_aws/resource/guardduty.py @@ -699,7 +699,9 @@ def add_finding( "FindingIds", expected_errors=["BadRequestException"], DetectorId=detector_id, - FindingCriteria={"Criterion": {"accountId": {"Eq": [builder.account.id]}}}, + FindingCriteria={ + "Criterion": {"accountId": {"Eq": [builder.account.id]}, "service.archived": {"Eq": ["false"]}}, + }, ): detector_id for detector_id in detector_ids } diff --git a/plugins/aws/fix_plugin_aws/resource/inspector.py b/plugins/aws/fix_plugin_aws/resource/inspector.py index 12246e961..a8b318dd6 100644 --- a/plugins/aws/fix_plugin_aws/resource/inspector.py +++ b/plugins/aws/fix_plugin_aws/resource/inspector.py @@ -151,7 +151,10 @@ def add_finding( action="list-findings", result_name="findings", expected_errors=["AccessDeniedException"], - filterCriteria={"awsAccountId": [{"comparison": "EQUALS", "value": f"{builder.account.id}"}]}, + filterCriteria={ + "awsAccountId": [{"comparison": "EQUALS", "value": f"{builder.account.id}"}], + "findingStatus": [{"comparison": "EQUALS", "value": "ACTIVE"}], + }, ): if finding := AwsInspectorFinding.from_api(item, builder): for fr in finding.finding_resources or []: diff --git a/plugins/aws/fix_plugin_aws/resource/ssm.py b/plugins/aws/fix_plugin_aws/resource/ssm.py index 38d744654..f27916b5d 100644 --- a/plugins/aws/fix_plugin_aws/resource/ssm.py +++ b/plugins/aws/fix_plugin_aws/resource/ssm.py @@ -384,7 +384,7 @@ class AwsSSMResourceCompliance(AwsResource, PhantomBaseResource): compliance_details: Optional[Dict[str, str]] = field(default=None, metadata={"description": "A Key:Value tag combination for the compliance item."}) # fmt: skip def parse_finding(self) -> Finding: - title = self.title or "" + title = self.title or (self.compliance_details or {}).get("DocumentName") or "" severity = SEVERITY_MAPPING.get(self.severity or "", Severity.medium) details = self.compliance_details if self.execution_summary: