Skip to main content

How to Find AWS Lambda functions have resource-based policy set as Public

Problem​

Publicly accessible services could expose sensitive data to bad actors.

info

This security check is part of the CIS Amazon Web Services Benchmarks and is rated severity low.

Prerequisites​

This guide assumes that you have already installed and configured Resoto to collect your AWS cloud resources.

Directions​

  1. Execute the following search command in Resoto Shell or Resoto UI:

    > search is(aws_lambda_function) and function_policy.statement[*].{principal~"*" or principal.AWS~"*" or principal.CanonicalUser~"*"}
    ​kind=aws_lambda_function, ..., region=resoto-poweruser
    ​kind=aws_lambda_function, ..., account=poweruser-team

  2. Pipe the search command into the dump command:

    > search is(aws_lambda_function) and function_policy.statement[*].{principal~"*" or principal.AWS~"*" or principal.CanonicalUser~"*"} | dump
    ​reported:
    ​  id: /aws/lambda/123
    ​  name: some-name
    ​  ctime: '2022-12-05T22:53:14Z'
    ​  kind: aws_lambda_function
    ​  age: 2mo28d

    The command output will list the details of all non-compliant aws_lambda_function resources.

  3. Fix detected issues by following the remediation steps:

    Grant usage permission on a per-resource basis and applying least privilege principle.

    note

    Please refer to the AWS Lambda documentation for details.

Further Reading​