Multiple Functions Should Not Have The Same IAM Role
More Info:
Amazon Lambda functions should not share the same AWS IAM execution role in order to promote the Principle of Least Privilege (POLP) by providing each individual function the minimal amount of access required to perform its tasks.Risk Level
HighAddress
SecurityCompliance Standards
SOC2Triage and Remediation
Remediation
Using Console
Using Console
Sure! Here are the step-by-step instructions to remediate the misconfiguration “Multiple Functions Should Not Have The Same IAM Role” for AWS:
- Log in to your AWS Management Console.
- Navigate to the AWS Lambda service from the Services menu.
- Select the function that has the same IAM role as another function.
- Scroll down to the “Permissions” section and click on the IAM role name.
- This will take you to the IAM console. Click on the “Create Role” button.
- In the “Create Role” wizard, select “AWS service” as the trusted entity and “Lambda” as the service that will use this role.
- Click on the “Next: Permissions” button.
- In the “Attach permissions policies” section, select the policies that your function needs to run.
- Click on the “Next: Tags” button.
- Add any tags that you want to associate with this role (optional).
- Click on the “Next: Review” button.
- Give the role a name and description.
- Click on the “Create Role” button.
- Go back to the Lambda function and scroll down to the “Permissions” section.
- Click on the “Edit” button next to the “Execution role” field.
- Select the newly created IAM role from the list.
- Click on the “Save” button.
Using CLI
Using CLI
To remediate this misconfiguration in AWS, you can follow the below steps using AWS CLI:Note: Replace Note: Replace Note: Replace
- Identify the functions that have the same IAM role assigned to them. You can use the following command to list all the functions and their IAM roles:
- Once you have identified the functions that have the same IAM role assigned to them, you can create a new IAM role for each function using the following command:
<new_role_name> with a unique name for the new IAM role and trust-policy.json with the path to a JSON file containing the trust policy for the role.- After creating the new IAM roles, you can update the function configurations to use the new IAM roles using the following command:
<function_name> with the name of the function that needs to be updated and <new_role_arn> with the ARN of the new IAM role created in step 2.- Repeat step 3 for all the functions that have the same IAM role assigned to them.
- Once all the functions have been updated to use unique IAM roles, you can delete the old shared IAM role using the following command:
<old_role_name> with the name of the old shared IAM role that needs to be deleted.By following these steps, you can remediate the misconfiguration of having multiple functions with the same IAM role in AWS.Using Python
Using Python
To remediate the misconfiguration “Multiple Functions Should Not Have The Same IAM Role” in AWS using Python, you can follow these steps:This script will loop through all the functions in your account and check if they are sharing their IAM role with any other function. If a function is sharing its IAM role, the script will create a new IAM role for the function, attach the necessary policies to the new role, and update the function to use the new IAM role.
-
Identify the functions that are sharing the same IAM role. You can use the AWS CLI command
aws lambda list-functionsto get a list of all the functions in your account and their associated IAM roles. -
For each function that is sharing the same IAM role with another function, create a new IAM role. You can use the AWS CLI command
aws iam create-roleto create a new IAM role with the necessary permissions for the function. -
Update each function to use the new IAM role. You can use the AWS CLI command
aws lambda update-function-configurationto update the function’s configuration and specify the new IAM role.