Lambda permission principal is wildcard

이 제품은 선택한 Datadog 사이트에서 지원되지 않습니다. ().
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

Id: ansible-aws-lambda-permission-principal-is-wildcard

Provider: AWS

Platform: Ansible

Severity: Medium

Category: Access Control

Learn More

Description

Lambda function permissions must not use wildcard principals (*). This effectively allows any AWS account or anonymous principal to invoke the function, increasing the risk of unauthorized invocations and data exposure.

In Ansible, check tasks using the amazon.aws.lambda_policy or lambda_policy modules and ensure the principal property does not contain * or other wildcard values. The principal must specify explicit principals such as an AWS account ARN, role ARN, or service principal (for example, arn:aws:iam::123456789012:role/MyRole or events.amazonaws.com). Tasks where principal includes * are flagged.

Secure example using an explicit service principal:

- name: Allow EventBridge to invoke Lambda
  amazon.aws.lambda_policy:
    state: present
    function_name: my-function
    principal: events.amazonaws.com
    action: lambda:InvokeFunction
    source_arn: arn:aws:events:us-east-1:123456789012:rule/MyRule

Compliant Code Examples

- name: Lambda S3 event notification negative
  amazon.aws.lambda_policy:
    state: present
    function_name: functionName
    alias: Dev
    statement_id: lambda-s3-myBucket-create-data-log
    action: lambda:AddPermission
    principal: s3.amazonaws.com
    source_arn: arn:aws:s3:eu-central-1:123456789012:bucketName
    source_account: 123456789012

Non-Compliant Code Examples

- name: Lambda S3 event notification
  amazon.aws.lambda_policy:
    state: present
    function_name: functionName
    alias: Dev
    statement_id: lambda-s3-myBucket-create-data-log
    action: lambda:AddPermission
    principal: "*"
    source_arn: arn:aws:s3:eu-central-1:123456789012:bucketName
    source_account: 123456789012