cis-aws-compute-12-5

name	cis-aws-compute-12.5
description	Ensure every Lambda function has its own IAM Role
category	cis-compute
version	1.1.0
author	cyberstrike-official
tags	["cis","aws","compute","lambda","serverless","iam","execution-role","least-privilege"]
cis_id	12.5
cis_benchmark	CIS AWS Compute Services Benchmark v1.1.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-compute-12.4","cis-aws-compute-12.7","cis-aws-compute-12.9"]
prerequisites	[]
severity_boost	{}

Ensure every Lambda function has its own IAM Role

Description

Every Lambda function should have a one to one IAM execution role and the roles should not be shared between functions.

Rationale

The Principle of Least Privilege means that any Lambda function should have the minimal amount of access required to perform its tasks. In order to accomplish this Lambda functions should not share IAM Execution roles.

Impact

Creating unique IAM roles for each Lambda function increases the number of IAM roles to manage but provides better security isolation between functions.

Audit Procedure

Using AWS Console

1. Login to the AWS console using https://console.aws.amazon.com/lambda/
2. In the left column, under AWS Lambda, click Functions.
3. Under Function name click on the name of the function that you want to review.
4. Click the Configuration tab
5. Under General configuration on the left column, click Permissions.
6. Under the Execution role section, Role name not the name listed as this is the IAM is the role that defines the access permissions for the selected function.
7. Repeat steps 2 - 6 for all the Lambda functions listed within the AWS region.
8. If any Lambda functions share the same Execution role, refer to the remediation below.
9. Repeat this Audit for all the AWS Regions.

Using AWS CLI

N/A - This control is Console-based audit only.

Expected Result

Each Lambda function has a unique IAM execution role that is not shared with any other Lambda function.

Remediation

Using AWS Console

1. Login to the AWS console using https://console.aws.amazon.com/lambda/
2. In the left column, under AWS Lambda, click Functions.
3. Under Function name click on the name of the function that you want to change/update.
4. Click the Configuration tab
5. Under General configuration on the left column, click Permissions.
6. Under the Execution role section, click Edit.
7. Scroll down to Execution role