Lambda function without tags

이 제품은 선택한 Datadog 사이트에서 지원되지 않습니다. ().
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

Id: ansible-aws-lambda-function-without-tags

Provider: AWS

Platform: Ansible

Severity: Low

Category: Insecure Configurations

Learn More

Description

AWS Lambda functions should be tagged so resources can be reliably inventoried and assigned ownership. Tags also enable tag-based access controls and automated security or operational workflows.

In Ansible playbooks, tasks using the amazon.aws.lambda or legacy lambda module must define the tags property as a mapping/dictionary. Resources where tags is undefined are flagged. Ensure tags is present on the module invocation and contains at least the necessary keys for your organization (for example, Owner, Environment, or Project).

Secure example:

- name: create application lambda
  amazon.aws.lambda:
    name: my-function
    state: present
    runtime: python3.9
    role: arn:aws:iam::123456789012:role/lambda-exec
    handler: app.handler
    tags:
      Owner: team-foo
      Environment: production
      Project: billing

Compliant Code Examples

- name: add tags
  amazon.aws.lambda:
    name: 'Lambda function'
    state: present
    zip_file: 'code.zip'
    runtime: 'python2.7'
    role: 'arn:aws:iam::987654321012:role/lambda_basic_execution'
    handler: 'hello_python.my_handler'
    tags:
      key1: 'value1'

Non-Compliant Code Examples

- name: add tags
  amazon.aws.lambda:
    name: 'Lambda function'
    state: present
    zip_file: 'code.zip'
    runtime: 'python2.7'
    role: 'arn:aws:iam::987654321012:role/lambda_basic_execution'
    handler: 'hello_python.my_handler'