post json message to slack channel using python

Question

My goal is to integrate security hub findings with slack channel. For that I have created aws event bridge rule with the target as SNS topic having AWS lambda as a subscription to it. I have referred this blog - https://aws.amazon.com/premiumsupport/knowledge-center/sns-lambda-webhooks-chime-slack-teams/

Lambda is written in python version 3.8.

import urllib3
import json
http = urllib3.PoolManager()
def lambda_handler(event, context):
    url = "https://hooks.slack.com/services/********"
    msg = {
        "channel": "#project-lambda",
        #"username": "WEBHOOK_USERNAME",
        "text": event['Records'][0]['Sns']['Message'],
        "icon_emoji": ""
    }

    encoded_msg = json.dumps(msg).encode('utf-8')
    resp = http.request('POST',url, body=encoded_msg)
    
    print({
        "message": event['Records'][0]['Sns']['Message'], 
        "status_code": resp.status, 
        "response": resp.data
    })

With the above code, I am able to receive the messages on slack channel from SNS whenever event rule is triggered but those messages are not in the readable format.

slack message output;

{"version":"0","id":"932c45e8-fdca-c2c0-25d7-7256467","detail-type":"Security Hub Findings - Imported","source":"aws.securityhub","account":"12345678","time":"2022-03-22T12:38:18Z","region":"us-east-1","resources":["arn:aws:securityhub:us-east-1::product/aws/securityhub/arn:aws:securityhub:us-east-1:12345678:subscription/aws-foundational-security-best-practices/v/1.0.0/S3.4/finding/5b012768-4639-4e5d-bd3c-34213876uh"],"detail":{"findings":[{"ProductArn":"arn:aws:securityhub:us-east-1::product/aws/securityhub","Types":["Software and Configuration Checks/Industry and Regulatory Standards/AWS-Foundational-Security-Best-Practices"],"Description":"This AWS control checks that your Amazon S3 bucket either has Amazon S3 default encryption enabled or that the S3 bucket policy explicitly denies put-object requests without server side encryption.","Compliance":{"Status":"FAILED"},
<<<< output omitted >>>>

Instead I am expecting output to show in below json format;

{
    "version": "0",
    "id": "932c45e8-fdca-c2c0-25d7-0cc89d76d336",
    "detail-type": "Security Hub Findings - Imported",
    "source": "aws.securityhub",
    "account": "858703963673",
    "time": "2022-03-22T12:38:18Z",
    "region": "us-east-1",
    "resources": ["arn:aws:securityhub:us-east-1::product/aws/securityhub/arn:aws:securityhub:us-east-1:858703963673:subscription/aws-foundational-security-best-practices/v/1.0.0/S3.4/finding/5b012768-4639-4e5d-bd3c-8ef4439540d6"],
    "detail": {
        "findings": [{
            "ProductArn": "arn:aws:securityhub:us-east-1::product/aws/securityhub",
            "Types": ["Software and Configuration Checks/Industry and Regulatory Standards/AWS-Foundational-Security-Best-Practices"],
            "Description": "This AWS control checks that your Amazon S3 bucket either has Amazon S3 default encryption enabled or that the S3 bucket policy explicitly denies put-object requests without server side encryption.",
            "Compliance": {
                "Status": "FAILED"
            },
<<<< output omitted >>>>

I believe this webhook apps doesn't support json format but is there a way to post the output on slack channel in json?

Answer 1

You can use "link_names": True in your payload:

    slack_data = {
                'text': _text,
                "icon_emoji": self._icon,
                "username": _sender,
                "link_names": True
                }