cis-aws-compute-12-7

name	cis-aws-compute-12.7
description	Ensure Lambda functions are referencing active execution roles
category	cis-compute
version	1.1.0
author	cyberstrike-official
tags	["cis","aws","compute","lambda","serverless","iam","execution-role","active-role"]
cis_id	12.7
cis_benchmark	CIS AWS Compute Services Benchmark v1.1.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-compute-12.4","cis-aws-compute-12.5","cis-aws-compute-12.9"]
prerequisites	[]
severity_boost	{}

Ensure Lambda functions are referencing active execution roles

Description

In order to have the necessary permissions to access the AWS cloud services and resources Amazon Lambda functions should be associated with active(available) execution roles.

Rationale

A Lambda function's execution role is an Identity and Access Management (IAM) role that grants the function permission to process and access specific AWS services and resources. When Amazon Lambda functions are not referencing active execution roles, the functions are losing the ability to perform critical operations securely.

Impact

Functions referencing inactive or deleted execution roles will fail to execute properly, potentially causing service disruptions.

Audit Procedure

Using AWS Console

1. Login to the AWS Console using https://console.aws.amazon.com/lambda/.
2. In the left column, under AWS Lambda, click Functions.
3. Under Function name click on the name of the function that you want to review
4. Click the Configuration tab
5. In the left column, click Permissions.
6. In the Resource summary section, if it reads "The role with name <role_name> cannot be found. (Service: LambdaConsole; Status Code: 404; Error Code: NoSuchEntity; Request ID: e3f12a73-2988-4dd5-b2d1-237c800a27f4; Proxy: null) refer to the remediation below.
7. Repeat steps 2 - 6 for each Lambda function available within the current AWS region.
8. Repeat this Audit for all the other AWS regions.

Using AWS CLI

1. Run aws lambda list-functions

aws lambda list-functions --output table --query "Functions[*].FunctionName"

This command will provide a table titled ListFunctions

2. Run aws lambda get-function

aws lambda get-function --function-name "name_of_function" --query "Configuration.Role"

This will provide an output returning the role ARN assigned to that function.

3. Run aws iam get-role

aws iam get-role --role-name "name_of_role"

This will return the requested configuration information.