Python Getting Specific JSON values from AWS GuardDuty

Question

I've written some code on AWS Lambda and I am trying to extract the IPs from GuardDuty's findings. I have gotten the FindingIds okay, but when I try and extract the IP address I get the following error:

{ "errorMessage": "list indices must be integers or slices, not str", "errorType": "TypeError", "stackTrace": [ [ "/var/task/lambda_function.py", 38, "lambda_handler", "print(loadFindings['Findings']['Resource']['NetworkInterfaces']['PublicIp'])" ] ] }

My full code is below so far:

import json
import boto3
from pprint import pprint # Pretty-print for displaying the JSON nicely.

#pprint(listOfFindings)

def lambda_handler(event, context):
    client = boto3.client('guardduty') # Creating the client.
    Det_ID = '5ab1b6808e98faaabd947a01af9ed970' # Setting the Detect ID for GD.
    response = client.list_findings(DetectorId=Det_ID) # Gathering all findings... Need to filter.
    findings = json.dumps(response) # Dumping the JSON findings
    listOfFindings = json.loads(findings) # Making them into a readable format for Python.
    # print("Here's the IDs!",listOfFindings['FindingIds'],"\n\n\n") # Printing all Finding IDs.

    idPosition=0
    idList = []
    for id in listOfFindings['FindingIds']: # Looping through all the Finding IDs. 
        #print("\n\n\nNumber", x, listOfFindings['FindingIds'][x]) # Prints all the Finding Ids separated.
        idList.append(listOfFindings['FindingIds'][idPosition])
        idPosition+=1

    # print("TEST") - Debugging.
    # print(idList) - Debugging.

    findingsList = []
    position = 0
    for ids in idList:
        # print(idList[position])
        stringFindingId = str(idList[position])
        #stringFindingId = idList[position]
        allFindings = client.get_findings(
            DetectorId=Det_ID,
            FindingIds=[
                stringFindingId,])
        dumpFindings = json.dumps(allFindings)
        loadFindings = json.loads(dumpFindings)
        # findingsList.append(loadFindings)
        print(loadFindings['Findings']['Resource']['NetworkInterfaces']['PublicIp']) # BROKEN HERE
        position += 1

Any help is really appreciated!

Alex Hall Alex Hall · Accepted Answer · 2018-05-24T19:36:47

The docs show that the value for 'Findings' is a list of dictionaries. So either just use allFindings['Findings'][0] (if there's only one item in the list) or loop over allFindings['Findings'].

By the way this code is pointless:

    dumpFindings = json.dumps(allFindings)
    loadFindings = json.loads(dumpFindings)

Python Getting Specific JSON values from AWS GuardDuty

1 Answers