Microsoft Sentinel | Data connectors - AWS

Question

Microsoft Sentinel | Data connectors - AWS

Arif Ali 0

The script provided by Microsoft does now work and fails in various places like with tags etc.

I would like to know if others are facing this issue?

"28/04/2025 12:43","Executing: aws iam create-role --role-name OIDC_SentinelIAMRole2 --assume-role-policy-document {""Version"":""2012-10-17"",""Statement"":[{""Effect"":""Allow"",""Principal"":{""Federated"":""arn:aws:iam::XXXXXXX:oidc-provider/sts.windows.net/XXXXXXXXXXX/""},""Condition"":{""StringEquals"":{""sts:RoleSessionName"":""MicrosoftSentinel_XXXXXXXXXXX"",""sts.windows.net/XXXXXXXXXXX/:aud"":""api://1462b192-27f7-4cb9-8523-0f4ecb54b47e""}},""Action"":""sts:AssumeRoleWithWebIdentity""}]} --tags [{""Key"":""Operator"",""Value"":""Microsoft_Sentinel_Automation_Script""}] 2>&1","Verbose"
"28/04/2025 12:43","System.Management.Automation.RemoteException Error parsing parameter '--tags': Invalid JSON: Expecting property name enclosed in double quotes: line 1 column 3 (char 2) JSON received: [{Key:Operator,Value:Microsoft_Sentinel_Automation_Script}]","Verbose"
"28/04/2025 12:43","JSON received: [{Key:Operator,Value:Microsoft_Sentinel_Automation_Script}]","Error"
"28/04/2025 12:43","Retrying...","Information"

https://learn.microsoft.com/en-us/azure/sentinel/connect-aws?tabs=s3

That is the article I am following.

Navya 17,900 Reputation points Microsoft External Staff

2025-04-28T18:45:25.14+00:00
Hi @Arif Ali

I understand that you are encountering an issue with the JSON format when executing the AWS IAM create-role command in your Python script. The error message indicates that there is a problem with the JSON formatting of the tags parameter.

Based on the error message you provided:

The error states: **"**Invalid JSON: Expecting property name enclosed in double quotes

The JSON received is: [{Key:Operator,Value:Microsoft_Sentinel_Automation_Script}]

To resolve this issue, you need to ensure that the tags parameter in your JSON payload is formatted correctly, with property names enclosed in double quotes. Here is the correct format for the tags parameter in JSON:

[{"Key":"Operator","Value":"Microsoft_Sentinel_Automation_Script"}]

Hope this helps. Do let us know if you any further queries.

Arif Ali 0

I have not edited the script in anyway, I am trying to run as is, however I have identified the code here which carries out the tags:

function Get-SentinelTagKey
{
    return "Operator"
}

function Get-SentinelTagValue
{
    return "Microsoft_Sentinel_Automation_Script"
}

function Get-SentinelTagInJsonFormat
{
    $key = Get-SentinelTagKey
    $value = Get-SentinelTagValue
    $sentinelTag = ConvertTo-Json -InputObject @{Key=$key;Value=$value} -Depth 99 -Compress
    return $sentinelTag
}

You can easily download the files from the article and inspect it too. I do not understand why it is this complicated.

Your answer

Navya 17,900 Reputation points Microsoft External Staff

2025-04-28T18:45:25.14+00:00

Hi @Arif Ali

I understand that you are encountering an issue with the JSON format when executing the AWS IAM create-role command in your Python script. The error message indicates that there is a problem with the JSON formatting of the tags parameter.

Based on the error message you provided:

The error states: **"**Invalid JSON: Expecting property name enclosed in double quotes

The JSON received is: [{Key:Operator,Value:Microsoft_Sentinel_Automation_Script}]

To resolve this issue, you need to ensure that the tags parameter in your JSON payload is formatted correctly, with property names enclosed in double quotes. Here is the correct format for the tags parameter in JSON:

[{"Key":"Operator","Value":"Microsoft_Sentinel_Automation_Script"}]

Hope this helps. Do let us know if you any further queries.
Arif Ali 0 Reputation points

2025-04-29T13:45:07.7+00:00

I have not edited the script in anyway, I am trying to run as is, however I have identified the code here which carries out the tags:

function Get-SentinelTagKey { return "Operator" } function Get-SentinelTagValue { return "Microsoft_Sentinel_Automation_Script" } function Get-SentinelTagInJsonFormat { $key = Get-SentinelTagKey $value = Get-SentinelTagValue $sentinelTag = ConvertTo-Json -InputObject @{Key=$key;Value=$value} -Depth 99 -Compress return $sentinelTag }

You can easily download the files from the article and inspect it too. I do not understand why it is this complicated.

Share via

Microsoft Sentinel | Data connectors - AWS

Your answer