Aws-sdk-ruby: Empty ListFindingResponse finding_arns array after call list_findings method.

[tiagocassio]

Confirm by changing [ ] to [x] below to ensure that it's a bug:

• [x] I've gone though Developer Guide for v3 and API reference
• [x] I've checked AWS Forums and StackOverflow for answers
• [x] I've searched for previous similar issues and didn't find any solution

Describe the bug
I'm trying to get findings by calling this method:

ret = client.list_findings({assessment_run_arns: ["arn:aws:inspector:us-west-2:123456789:target/xxx/template/xxxx/run/xxxxx"], max_results: 100})

but the returned result is always:

#<struct Aws::Inspector::Types::ListFindingsResponse finding_arns=[]...>

so, if i want to get the finding direcly passing the array arns, like:

ret2 = client.describe_findings({finding_arns: ['arn:aws:inspector:us-west-2:1232456789:target/0-xxx/template/0-xxxxx/run/0-xxxxx/finding/0-xxxxx']})

The finding is returned.

Gem Version
gem 'aws-sdk', '~> 3'

Version of Ruby, OS environment
ruby 2.6.5p114 (2019-10-01 revision 67812) [x86_64-linux]

To Reproduce (observed behavior)

1. In the Rails console, call the client:
   client = Aws::Inspector::Client.new(region: 'us-west-2', credentials: Aws::Credentials.new('asdfgghasddf', 'assdddsass'))

2. In the same console, run the assessment run list method:
   assessment = client.list_assessment_runs

3. Continuing the same console, get the assessment array list and pass into list_findings:
   list_findings = client.list_findings({assessment_run_arns: assessment.assessment_run_arns, max_results: 100})

Now, the returned finding list is empty, even if has findings attached to this assessment.

Expected behavior
The returned ListFindingResponse class with finding_arns array not empty.

Screenshots
I'm not able to do this.

Additional context
If set the arn of the finding and call:

finding = client.describe_findings({finding_arns: ['arn:aws:inspector:us-west-2:123456789:target/0-xxxxxx/template/0-xxxxxx/run/0-xxxxxx/finding/0-xxxxxx']})

I can get the finding correctly.

[mullermp]

I was able to reproduce this. I am getting in contact with the service team. I believe usage is correct.

[tiagocassio]

Thanks @mullermp, i'm glad to get help.

[mullermp]

Can you verify that you can get findingArns using the CLI?

aws inspector list-findings --assessment-run-arns (paste arn here)

[tiagocassio]

Yes, on the CLI is being returned all findings.

[mullermp]

I am also able to use the CLI. A work around for now might be to shell out to the CLI using back ticks. It seems that it's a problem with the service. I have ticketed the relevant teams. If you enable client wire tracing or use -v in the console, you'll see the response from the service (in raw JSON) does not include arns: -> "{\"findingArns\":[],\"nextToken\":\"AAIAARk-lHVc55YF9fpiwmoQEoVcDKjP5_a_kwL1sHxUvLfyznuStTO8CZrcChn-mRtLAPIfha_qXsr_0FbQX204h8kVU9uB3jGTgzOqgb2-nY23SIFTzWsHKQ==\"}"

[tiagocassio]

Okay, thanks, appreciate your help.

[mullermp]

@tiagocassio I got some clarification from the service team. It looks that, you need to paginate your responses, even if the response is empty. In the SDK, you can use next_page? and next_page to cycle through the responses. I was able to verify that I got all of the results, eventually, by making multiple requests.

My take on this: this is a poor customer experience. I will push on the Inspector team to return all values up until max_results. It is not expected that an empty result set can be treated as a paginated response to eventually get results.

[mullermp]

Another chat with the service team -- as per API standards, when you don't supply a filter, it's likely that the API reaches a maximum execution time, and it prefers to return fast rather than wait on responses. I think this makes sense. The API standards ALSO say that this behavior MUST be documented in the client API which it IS NOT. Inspector Doc Writing team will own adding documentation to APIs to describe this behavior under max_results. I hope that clarifies any confusion @tiagocassio

[tiagocassio]

@tiagocassio I got some clarification from the service team. It looks that, you need to paginate your responses, even if the response is empty. In the SDK, you can use next_page? and next_page to cycle through the responses. I was able to verify that I got all of the results, eventually, by making multiple requests.

My take on this: this is a poor customer experience. I will push on the Inspector team to return all values up until max_results. It is not expected that an empty result set can be treated as a paginated response to eventually get results.

I've tested this approach but without success, even passing max_results param. See the request code and the response image:

findings = client.list_findings({max_results: 100})

[mullermp]

@tiagocassio You will need to do ret = ret.next_page in your loop. Otherwise your next_tokens would all be the same. This guide can help, too: https://docs.aws.amazon.com/sdk-for-ruby/v3/developer-guide/paging-responses.html

[tiagocassio]

Hi @mullermp, i've tried through another method next_page? and printing next_page to get finding_arns, but same, return is empty. In the two screens, the next_token is changed in every request, even if i loop while next_page? or until last_page?.

[alextwoods]

@tiagocassio - it looks like you’re not updating ret with the next page of results in the loop. Try
puts ret = ret.next_page until ret.last_page?

[tiagocassio]

Thanks for the tip, @alextwoods!