| name | cis-aws-compute-12.10 |
| description | Ensure Lambda functions do not allow unknown cross account access via permission policies |
| category | cis-compute |
| version | 1.1.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","compute","lambda","serverless","cross-account","access-control","resource-policy"] |
| cis_id | 12.10 |
| cis_benchmark | CIS AWS Compute Services Benchmark v1.1.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-compute-12.4","cis-aws-compute-12.6","cis-aws-compute-12.9"] |
| prerequisites | [] |
| severity_boost | {} |
Ensure Lambda functions do not allow unknown cross account access via permission policies
Description
Ensure that all your Amazon Lambda functions are configured to allow access only to trusted AWS accounts in order to protect against unauthorized cross-account access.
Rationale
Allowing unknown (unauthorized) AWS accounts to invoke your Amazon Lambda functions can lead to data exposure and data loss. To prevent any unauthorized invocation requests for your Lambda functions, restrict access only to trusted AWS accounts.
Impact
Restricting cross-account access may break existing integrations with partner or trusted accounts. Ensure all legitimate cross-account relationships are documented before restricting access.
Audit Procedure
Using AWS Console
- Login to the AWS Console using https://console.aws.amazon.com/lambda/.
- In the left column, under
AWS Lambda, click Functions.
- Under
Function name click on the name of the function that you want to review
- Click the Configuration tab
- In the left column, click
Permissions.
- In the
Resource-based policy statements section, click View policy document
- Review the Resource-based policy document box. Find the "Principal" element and check the element value (ARN).
- Confirm that each AWS account ARN is an approved AWS account. If one or more of the ARNs is not an AWS account defined within your organization, refer to the remediation below.
- Repeat steps no. 2-8 for each Lambda function available within the current AWS region.
- Repeat this Audit for all the other AWS regions.
Using AWS CLI
- Run
aws lambda list-functions
aws lambda list-functions --output table --query "Functions[*].FunctionName"
-
This command will provide a table titled ListFunctions
-
Run aws lambda get-policy on the functions listed
aws lambda get-policy --function-name "name_of_function" --output text --query "Policy"
- This will provide an output of the policy assigned to that function.
- Identify the "Principal" element for each function for the ARN.
