Repository: cloud-custodian/cloud-custodian

Issue:
[SecurityHub] Findings format seems to require a 'Description' field that is not  supplied
The SecurityHub findings format seems to have changed, such that it has a requirement that a 'Description' field should be provided which Cloud Custodian doesn't honour. 

'FailedFindings': [{'Id': 'eu-west-1/627886280200/a4c96f76077a6a98477f63fbd679d331/e2e53110f710e5e82ae9e7c7d174d6f9', 'ErrorCode': 'InvalidInput', 'ErrorMessage': "Finding does not adhere to Amazon Finding Format. data should have required property 'Description'."}]}



Discussion:
looks they just went GA and did some minor incompatible api change along the way (description required). We'll need to cut a new release as well. note you can add a `description` field to your `policy` (not action) and it will be used for the description field. it looks we just need to add description to schema, and maybe add a non null default (policy name).

Resolving patch:
diff --git a/c7n/actions/securityhub.py b/c7n/actions/securityhub.py
--- a/c7n/actions/securityhub.py
+++ b/c7n/actions/securityhub.py
@@ -62,6 +62,8 @@ class PostFinding(BaseAction):
            - shield-enabled
          actions:
            - type: post-finding
+             description: |
+                Shield should be enabled on account to allow for DDOS protection (1 time 3k USD Charge).
              severity_normalized: 6
              types:
                - "Software and Configuration Checks/Industry and Regulatory Standards/NIST CSF Controls (USA)"
@@ -82,6 +84,7 @@ class PostFinding(BaseAction):
         "post-finding",
         required=["types"],
         title={"type": "string"},
+        description={'type': 'string'},
         severity={"type": "number", 'default': 0},
         severity_normalized={"type": "number", "min": 0, "max": 100, 'default': 0},
         confidence={"type": "number", "min": 0, "max": 100},
@@ -220,9 +223,14 @@ def get_finding(self, resources, existing_finding_id, created_at, updated_at):
                 self.ProductName,
             ),
             "AwsAccountId": self.manager.config.account_id,
+            # Long search chain for description values, as this was
+            # made required long after users had policies deployed, so
+            # use explicit description, or policy description, or
+            # explicit title, or policy name, in that order.
             "Description": self.data.get(
-                "description", policy.data.get("description", "")
-            ).strip(),
+                "description", policy.data.get(
+                    "description",
+                    self.data.get('title', policy.name))).strip(),
             "Title": self.data.get("title", policy.name),
             'Id': finding_id,
             "GeneratorId": policy.name,


Test patch:
diff --git a/tests/test_securityhub.py b/tests/test_securityhub.py
--- a/tests/test_securityhub.py
+++ b/tests/test_securityhub.py
@@ -62,6 +62,7 @@ def test_bucket(self):
                 "actions": [
                     {
                         "type": "post-finding",
+                        'description': 'This one is important',
                         "types": [
                             "Software and Configuration Checks/AWS Security Best Practices/Network Reachability"  # NOQA
                         ],