02 - Lambda Public Access

Ensure Lambda functions are not publicly exposed

Ensure that your Lambda functions are not publicly exposed by validating their access policy. This will help with protecting the function against unauthorized users that are sending request to invoke these functions. For this reason this is considered a security best practice and should have public access removed. Ensuring this is enabled will help you with PCI-DSS and GDPR compliance.

Audit & Remediation

Login into your AWS account
Navigate to the lambda service at: https://console.aws.amazon.com/lambda
On the left hand panel select Functions .

Select the function under Function name in order to gain access to the individual function.
Select the Permissions tab the scroll down to the Resource-based policy section.

If no policy is found, then your function is not public.
If you currently do have a policy set, Inside the Lambda function policy box, check the Principal element value. If the Principal element has one of the following values: "*" or { "AWS": "*" } and the function policy is not using any Condition clauses such as 'Condition': {"StringEquals": { "AWS:SourceAccount": "" } } to filter the access, the selected Amazon Lambda function is exposed to anonymous access.

In order to remediate this issue, you must handle this via the aws-cli.
Follow the directions outlined at https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html
Repeat the outlined steps for each function.
Repeat the outlined steps for each region you have functions running.

See all of your AWS Lambda Functions in a single place!

Do you want to see all of your Lambda Functions in once place for all regions and all accounts?
Login to our online demo to see exactly what this looks like.
demo.intelligentdiscovery.io

Other Key Features

Inventory

Consolidate your inventory management with consistent and frequent security logs, inventories, and change logs. Dashboard reporting for extensive analytical value.

learn more +

Cost & Usage

Access consolidated capacity, cost, and volume tools in a scaling environment without impacting production or breaking the bank.