Lambda Functions Should Not Have Administrative Permissions
More Info:
Your Amazon Lambda functions should not have administrative permissions in order to promote the Principle of Least Privilege.Risk Level
HighAddress
SecurityCompliance Standards
PCIDSS, HIPAATriage and Remediation
Remediation
Using Console
Using Console
Sure, here are the step-by-step instructions to remediate the misconfiguration of Lambda Functions having administrative permissions in AWS:
- Open the AWS Management Console and navigate to the AWS Lambda service.
- Select the Lambda function for which you want to remediate the misconfiguration.
- In the “Configuration” tab, click on the “Permissions” section.
- Under the “Execution role” section, click on the role name to open the “IAM Console”.
- In the “IAM Console”, click on the “Permissions” tab.
- Click on the “Attach policies” button.
- Search for the policy “AWSLambdaBasicExecutionRole” and select it.
- Click on the “Attach policy” button to attach the policy to the role.
- Remove any other policies that provide administrative permissions to the Lambda function.
- Save the changes and exit the “IAM Console”.
Using CLI
Using CLI
To remediate the misconfiguration “Lambda Functions Should Not Have Administrative Permissions” in AWS using AWS CLI, follow the below steps:Replace This command should return an empty policy, indicating that the Lambda function no longer has administrative permissions.
- Open the AWS CLI on your local machine.
- Run the following command to list all the Lambda functions in your AWS account:
- Identify the Lambda function(s) that have administrative permissions.
- Run the following command to remove the administrative permissions from the Lambda function(s):
<function_name> with the name of the Lambda function and <statement_id> with the statement ID of the administrative permission.- Verify that the administrative permission has been removed by running the following command:
- Repeat steps 4 and 5 for all the Lambda functions that have administrative permissions.
- Once you have removed the administrative permissions from all the Lambda functions, verify the remediation by running a compliance check using a tool like AWS Config.
Using Python
Using Python
To remediate this misconfiguration in AWS, you can follow these steps using Python:This code will create a new IAM Role named
-
Identify the Lambda functions that have administrative permissions by checking the
Roleattached to the function. - Create a new IAM Role with the necessary permissions that the Lambda function requires and attach it to the function. This new role should have the least privilege required for the function to operate.
-
Update the function’s execution role to the new role using the AWS SDK for Python,
boto3.
new-lambda-role with the necessary permissions for the Lambda function to operate. It will then update the function’s execution role to the new role. Finally, it will update the new role with the necessary permissions.