​
Event Information

  • The UpdateFunctionConfiguration event in AWS Lambda refers to a specific event that occurs when there is a change in the configuration settings of a Lambda function.
  • This event is triggered when there is an update made to the function’s configuration, such as changes to the function name, memory allocation, timeout duration, environment variables, or resource requirements.
  • The UpdateFunctionConfiguration event is useful for tracking and monitoring changes made to Lambda functions, allowing developers and administrators to keep track of any modifications made to the function’s configuration settings.

​
Examples

  • Unauthorized access to sensitive environment variables: If security is impacted with UpdateFunctionConfiguration in AWS Lambda, it could potentially allow unauthorized access to sensitive environment variables. This could lead to the exposure of sensitive information or credentials, compromising the security of the Lambda function and any associated resources.
  • Insecure function permissions: Another security impact could be the modification of function permissions during the update process. If not properly managed, this could result in granting excessive permissions to the Lambda function, allowing it to access or modify resources it shouldn’t have access to. This can lead to unauthorized actions or data breaches.
  • Vulnerability to code injection attacks: UpdateFunctionConfiguration can also impact security by introducing vulnerabilities to code injection attacks. If the update process allows for the modification of the function’s code or dependencies in an insecure manner, it could potentially enable an attacker to inject malicious code into the function, leading to unauthorized access or execution of arbitrary code.

​
Remediation

​
Using Console

  1. Identify the specific issue or vulnerability in the AWS Lambda function by reviewing the event logs or security findings in the AWS console.
  2. Determine the appropriate remediation steps based on the examples provided in the previous response: a. Example 1: Excessive permissions for Lambda function
    • Access the AWS Lambda console.
    • Select the specific Lambda function that has excessive permissions.
    • Click on the “Permissions” tab.
    • Review the existing permissions and identify any unnecessary or excessive permissions.
    • Remove the unnecessary permissions by clicking on the “X” icon next to each permission.
    • Click on “Save” to apply the changes.
    b. Example 2: Insecure environment variables in Lambda function
    • Access the AWS Lambda console.
    • Select the specific Lambda function that has insecure environment variables.
    • Click on the “Configuration” tab.
    • Scroll down to the “Environment variables” section.
    • Review the existing environment variables and identify any sensitive information.
    • Remove or encrypt any sensitive environment variables.
    • Click on “Save” to apply the changes.
    c. Example 3: Unencrypted data storage in Lambda function
    • Access the AWS Lambda console.
    • Select the specific Lambda function that has unencrypted data storage.
    • Click on the “Configuration” tab.
    • Scroll down to the “Environment variables” section.
    • Review the existing environment variables and identify any variables related to data storage.
    • Ensure that the data storage variables are configured to use encrypted storage options such as AWS KMS or S3 server-side encryption.
    • Click on “Save” to apply the changes.
  3. Monitor the AWS Lambda function after applying the remediation steps to ensure that the identified issues have been resolved and the function is now compliant with security best practices.

​
Using CLI

  1. Enable VPC configuration for AWS Lambda:
    • Use the update-function-configuration command to update the Lambda function’s configuration.
    • Specify the --vpc-config parameter with the appropriate VPC configuration details, such as SubnetIds and SecurityGroupIds.
    • Example command: aws lambda update-function-configuration --function-name <function-name> --vpc-config SubnetIds=<subnet-ids>,SecurityGroupIds=<security-group-ids>
  2. Enable encryption at rest for AWS Lambda function code:
    • Use the update-function-configuration command to update the Lambda function’s configuration.
    • Specify the --kms-key-arn parameter with the ARN of the KMS key to be used for encryption.
    • Example command: aws lambda update-function-configuration --function-name <function-name> --kms-key-arn <kms-key-arn>
  3. Enable AWS CloudTrail logging for AWS Lambda:
    • Use the update-function-configuration command to update the Lambda function’s configuration.
    • Specify the --tracing-config parameter with the appropriate tracing configuration details, such as Mode set to Active.
    • Example command: aws lambda update-function-configuration --function-name <function-name> --tracing-config Mode=Active

​
Using Python

  1. Example 1: Increase Lambda function timeout
    • Identify the Lambda function that requires a timeout increase.
    • Use the AWS SDK for Python (Boto3) to update the function’s configuration.
    • Set the timeout parameter to a higher value, such as 5 minutes (300 seconds).
    • Here’s an example Python script to achieve this:
import boto3

lambda_client = boto3.client('lambda')

def increase_timeout(lambda_function_name):
    response = lambda_client.update_function_configuration(
        FunctionName=lambda_function_name,
        Timeout=300
    )
    print(f"Timeout increased for Lambda function {lambda_function_name}")

increase_timeout('my-lambda-function')
  1. Example 2: Enable VPC configuration for Lambda function
    • Identify the Lambda function that needs to be associated with a VPC.
    • Use the AWS SDK for Python (Boto3) to update the function’s configuration.
    • Set the VpcConfig parameter with the appropriate VPC configuration details.
    • Here’s an example Python script to achieve this:
import boto3

lambda_client = boto3.client('lambda')

def enable_vpc(lambda_function_name, vpc_id, subnet_ids):
    response = lambda_client.update_function_configuration(
        FunctionName=lambda_function_name,
        VpcConfig={
            'SubnetIds': subnet_ids,
            'SecurityGroupIds': [],
            'VpcId': vpc_id
        }
    )
    print(f"VPC configuration enabled for Lambda function {lambda_function_name}")

enable_vpc('my-lambda-function', 'vpc-12345678', ['subnet-12345678', 'subnet-87654321'])
  1. Example 3: Enable encryption at rest for Lambda function
    • Identify the Lambda function that needs encryption at rest.
    • Use the AWS SDK for Python (Boto3) to update the function’s configuration.
    • Set the KMSKeyArn parameter with the ARN of the KMS key to be used for encryption.
    • Here’s an example Python script to achieve this:
import boto3

lambda_client = boto3.client('lambda')

def enable_encryption(lambda_function_name, kms_key_arn):
    response = lambda_client.update_function_configuration(
        FunctionName=lambda_function_name,
        KMSKeyArn=kms_key_arn
    )
    print(f"Encryption at rest enabled for Lambda function {lambda_function_name}")

enable_encryption('my-lambda-function', 'arn:aws:kms:us-east-1:123456789012:key/abcd1234-5678-90ef-ghij-klmnopqrstuv')