Repository: cloud-custodian/cloud-custodian

Issue:
post-finding action of aws.distribution resource is throwing error
@ajkerrigan  @kapilt 
### Describe the bug

Discussed in https://github.com/cloud-custodian/cloud-custodian/discussions/7547

While trying to post a finding for one of cloudfront distribution, which had WebACL configured, the post-finding action was throwing the below error

```
[ec2-user]$ c7n-org run -c ../accounts.yml -s out -u ./test-distribution-det.yml --cache-period 0 -a test-account
2022-07-04 14:05:18,131: c7n_org:ERROR Exception running policy:test-cloudfront-tls account:test-account region:us-east-1 error:Parameter validation failed:
Unknown parameter in Findings[0].Resources[0].Details.AwsCloudFrontDistribution: "WebACLId", must be one of: CacheBehaviors, DefaultCacheBehavior, DefaultRootObject, DomainName, ETag, LastModifiedTime, Logging, Origins, OriginGroups, ViewerCertificate, Status, WebAclId
2022-07-04 14:05:18,143: c7n_org:INFO Policy resource counts Counter({'test-cloudfront-tls': 0})
[ec2-user]$
```
I guess it is because, the Security Hub expects the parameter "WebAclId"(screenshot below), but the custodian code is passing "WebACLId". Can you please verify once ?

![image](https://user-images.githubusercontent.com/100936221/177200553-77046523-c3c6-4b37-95c6-fc3d8df3acd5.png)

Reference URL: https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub.pdf

I have raised one more issue related to Cloudfront distribution here https://github.com/cloud-custodian/cloud-custodian/issues/7529

### What did you expect to happen?

I expected the custodian to post the finding to security hub

### Cloud Provider

Amazon Web Services (AWS)

### Cloud Custodian version and dependency information

```shell
Please copy/paste the following info along with any bug reports:

Custodian:   0.9.17
Python:      3.7.10 (default, Jun  3 2021, 00:02:01) 
             [GCC 7.3.1 20180712 (Red Hat 7.3.1-13)]
Platform:    posix.uname_result(sysname='Linux', nodename='ip-xxx-xxx-xxx-xxx.aws.xxxxx.com', release='4.14.276-211.499.amzn2.x86_64', version='#1 SMP Wed Apr 27 21:08:48 UTC 2022', machine='x86_64')
Using venv:  False
Docker: False
Installed:
```


### Policy

```shell
policies:        
  - name: test-cloudfront-tls
    resource: distribution
    description: "Policy to ensure Traffic for distribution networks must be encrypted with a minimum of TLSv1.2."
    conditions:
      - type: value
        key: region
        op: eq
        value: "us-east-1"
    filters:
      - type: value
        key: "ViewerCertificate.MinimumProtocolVersion"
        value: ["TLSv1.1_2016", "TLSv1_2016", "TLSv1", "SSLv3"]
        op: in
    actions:
      - type: post-finding
        severity_label: MEDIUM
        types:
          - "Software and Configuration Checks/Industry and Regulatory Standards/NIST CSF Controls (USA)"
        recommendation: "Traffic for distribution networks must be encrypted with a minimum of TLSv1.2."
        recommendation_url: "https://www.example.com/policies/AntiDDoS.html"
        confidence: 100
        compliance_status: FAILED
```


### Relevant log/traceback output

```shell
[ec2-user]$ c7n-org run -c ../accounts.yml -s out -u ./test-distribution-det.yml --cache-period 0 -a test-account
2022-07-04 14:05:18,131: c7n_org:ERROR Exception running policy:test-cloudfront-tls account:test-account region:us-east-1 error:Parameter validation failed:
Unknown parameter in Findings[0].Resources[0].Details.AwsCloudFrontDistribution: "WebACLId", must be one of: CacheBehaviors, DefaultCacheBehavior, DefaultRootObject, DomainName, ETag, LastModifiedTime, Logging, Origins, OriginGroups, ViewerCertificate, Status, WebAclId
2022-07-04 14:05:18,143: c7n_org:INFO Policy resource counts Counter({'test-cloudfront-tls': 0})
[ec2-user]$
```


### Extra information or context

_No response_


Discussion:
Thanks for the report @vgsachin839 - this is a good find :+1: ! I added a test specifically for posting distribution findings recently, due to another issue. But the distribution didn't have a web ACL associated with it, so wouldn't have hit this issue. Looks like there's a casing difference between the format the CloudFront API returns and what SecurityHub expects. I'll have to update the test to reproduce the failure, and tweak the `post-finding` action to fix it.
> Thanks for the report @vgsachin839 - this is a good find 👍 ! I added a test specifically for posting distribution findings recently, due to another issue. But the distribution didn't have a web ACL associated with it, so wouldn't have hit this issue. Looks like there's a casing difference between the format the CloudFront API returns and what SecurityHub expects. I'll have to update the test to reproduce the failure, and tweak the `post-finding` action to fix it.

Sure. Thanks @ajkerrigan.

Resolving patch:
diff --git a/c7n/resources/cloudfront.py b/c7n/resources/cloudfront.py
--- a/c7n/resources/cloudfront.py
+++ b/c7n/resources/cloudfront.py
@@ -371,7 +371,7 @@ def format_resource(self, r):
 
         payload.update(self.filter_empty({
             'DomainName': r['DomainName'],
-            'WebACLId': r.get('WebACLId'),
+            "WebAclId": r.get('WebACLId'),
             'LastModifiedTime': r['LastModifiedTime'].isoformat(),
             'Status': r['Status'],
             'Logging': self.filter_empty(r.get('Logging', {})),


Test patch:
diff --git a/tests/data/placebo/test_distribution_post_finding/cloudfront.GetDistributionConfig_1.json b/tests/data/placebo/test_distribution_post_finding/cloudfront.GetDistributionConfig_1.json
--- a/tests/data/placebo/test_distribution_post_finding/cloudfront.GetDistributionConfig_1.json
+++ b/tests/data/placebo/test_distribution_post_finding/cloudfront.GetDistributionConfig_1.json
@@ -233,9 +233,9 @@
                     ]
                 }
             },
-            "WebACLId": "",
+            "WebACLId": "1ebe0b46-0fd2-4e07-a74c-27bf25adc0bf",
             "HttpVersion": "http2",
             "IsIPV6Enabled": false
         }
     }
-}
\ No newline at end of file
+}
diff --git a/tests/data/placebo/test_distribution_waf/cloudfront.ListDistributions_2.json b/tests/data/placebo/test_distribution_waf/cloudfront.ListDistributions_2.json
--- a/tests/data/placebo/test_distribution_waf/cloudfront.ListDistributions_2.json
+++ b/tests/data/placebo/test_distribution_waf/cloudfront.ListDistributions_2.json
@@ -278,4 +278,4 @@
             }
         }
     }
-}
\ No newline at end of file
+}