| name | cis-aws-compute-12.9 |
| description | Ensure there are no Lambda functions with admin privileges within your AWS account |
| category | cis-compute |
| version | 1.1.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","compute","lambda","serverless","iam","admin-privileges","least-privilege","over-permission"] |
| cis_id | 12.9 |
| cis_benchmark | CIS AWS Compute Services Benchmark v1.1.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-compute-12.4","cis-aws-compute-12.5","cis-aws-compute-12.10"] |
| prerequisites | [] |
| severity_boost | {} |
Ensure there are no Lambda functions with admin privileges within your AWS account
Description
Ensure that your Amazon Lambda functions don't have administrative permissions potentially giving the function access to all AWS cloud services and resources.
Rationale
In order to promote the Principle of Least Privilege (POLP) and provide your functions the minimal amount of access required to perform their tasks the right IAM execution role associated with the function should be used. Instead of providing administrative permissions you should grant the role the necessary permissions that the function really needs.
Impact
Removing admin privileges from Lambda execution roles may break functions that rely on broad permissions. Functions should be tested after permission changes.
Audit Procedure
Using AWS Console
- Login in to the AWS Console using https://console.aws.amazon.com/lambda/
- In the left column, under
AWS Lambda, click Functions.
- Under
Function name click on the name of the function that you want to review
- Click the Configuration tab
- Click on
Permissions in the left column.
- In the Execution role section, click the
Role name to access the IAM role details.
**Note this will bring you to the IAM Console.
- Select the Permissions tab to view the identity-based policies attached
- In the Permissions policies section click on the Policy name.
- Select the Permissions tab.
**Note The policy summary should show below in JSON format.
- Within the {} JSON policy, identify the "Action" element defined for each statement and check the value.
- If any of the "Action" element values are set to "*" and the "Effect" element is set to "Allow", the role policy provides access to all the supported AWS cloud services and resources.
- Repeat this step for each IAM policy attached to the selected execution role.
If one or more policies allow access to all AWS services and resources, the execution role provides administrative permissions. Refer to the remediation below.
Repeat steps for each Lambda function within the current region.
Then repeat the Audit process for all other regions.
Using AWS CLI
N/A - This control requires manual review of IAM policies through the Console.
Expected Result
No Lambda function execution role has policies with "Action": "*" and "Effect": "Allow", ensuring no function has administrative privileges.
Remediation
Using AWS Console
