Repository: cloud-custodian/cloud-custodian

Issue:
[SecurityHub] Cross-Region aggregation not working
We are trying to deploy a policy which identifies new IAM user creation. The policy is deployed into us-east-1 region as this is where the IAM events are sent to - using the below command:

```
custodian run --assume arn:aws:iam::${AWS::AccountId}:role/CloudCustodianAdminRole --output-dir output/logs -r us-east-1 policies/us-east-1/*
```
The policy we are deploying is:
```yaml
policies:
  - name: IAM-user-created-in-the-account
    resource: iam-user
    description: |
      If IAM users are created in the account this will send a notification to Security Hub.
    mode: 
      type: cloudtrail
      events: 
        - source: iam.amazonaws.com
          event: CreateUser
          ids: responseElements.user.userName 
      role: arn:aws:iam::{account_id}:role/CloudCustodianAdminRole
      member-role: arn:aws:iam::{account_id}:role/CloudCustodianAdminRole
      packages: [boto3, botocore, urllib3] 
    actions:
      - type: post-finding
        region: eu-west-1
        severity_normalized: 30
        types:
          - "TTPs/Privilege Escalation"
        confidence: 100
        compliance_status: WARNING
        recommendation: "Avoid the use of IAM users when you are using Active Directory Federation"
```
The policy is deploying fine and is triggered correctly. But we see the following errors in the logs when trying to post finding to Security Hub in eu-west-1, which is the Security Hub master.
```
botocore.errorfactory.AccessDeniedException: An error occurred (AccessDeniedException) when calling the BatchImportFindings operation: User: arn:aws:sts::<account>:assumed-role/CloudCustodianAdminRole/CloudCustodian is not authorized to perform: securityhub:BatchImportFindings
[ERROR]	2019-05-08T08:46:16.357Z	error during policy execution
Traceback (most recent call last):
File "/var/task/c7n/handler.py", line 168, in dispatch_event
p.push(event, context)
File "/var/task/c7n/policy.py", line 909, in push
return mode.run(event, lambda_ctx)
File "/var/task/c7n/policy.py", line 478, in run
results = action.process(resources)
File "/var/task/c7n/actions/securityhub.py", line 213, in process
Findings=[finding])
File "/var/task/botocore/client.py", line 357, in _api_call
return self._make_api_call(operation_name, kwargs)
File "/var/task/botocore/client.py", line 661, in _make_api_call
raise error_class(parsed_response, operation_name)
```

The CloudCustodianAdminRole has a pure admin access policy.


Discussion:

Resolving patch:
diff --git a/c7n/actions/securityhub.py b/c7n/actions/securityhub.py
--- a/c7n/actions/securityhub.py
+++ b/c7n/actions/securityhub.py
@@ -243,6 +243,7 @@ def process(self, resources, event=None):
     def get_finding(self, resources, existing_finding_id, created_at, updated_at):
         policy = self.manager.ctx.policy
         model = self.manager.resource_type
+        region = self.data.get('region', self.manager.config.region)
 
         if existing_finding_id:
             finding_id = existing_finding_id
@@ -258,7 +259,7 @@ def get_finding(self, resources, existing_finding_id, created_at, updated_at):
         finding = {
             "SchemaVersion": self.FindingVersion,
             "ProductArn": "arn:aws:securityhub:{}:{}:product/{}/{}".format(
-                self.manager.config.region,
+                region,
                 self.manager.config.account_id,
                 self.manager.config.account_id,
                 self.ProductName,


Test patch: