Publicly accessible Lambda function uses a privileged IAM role

Docs > Datadog Security > OOTB Rules > Publicly accessible Lambda function uses a privileged IAM role

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Description

A misconfigured Lambda execution role contains risky privileges. A privileged IAM role attached to a Lambda function can lead to an AWS account compromise if the underlying function code has an application-level vulnerability or can be modified by the attacker. This Lambda function is publicly accessible, making it easier for attackers to exploit the function.

Remediation

Reduce the permissions attached to the Lambda execution role using the concept of least-privileged access. You can use AWS Access Advisor.
Once you identify effective permissions used by your Lambda function, use AWS IAM Access Analyzer to generate an IAM policy based on past CloudTrail events.
Redeploy the role to the Lambda Function.