Menu
Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.
Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-compute-12-6O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.
Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.
Baseado na classificação ocupacional SOC
Exibindo SKILL.md
| name | cis-aws-compute-12.6 |
| description | Ensure Lambda functions are not exposed to everyone |
| category | cis-compute |
| version | 1.1.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","compute","lambda","serverless","public-access","permissions","resource-policy"] |
| cis_id | 12.6 |
| cis_benchmark | CIS AWS Compute Services Benchmark v1.1.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-compute-12.4","cis-aws-compute-12.9","cis-aws-compute-12.10"] |
| prerequisites | [] |
| severity_boost | {} |
A publicly accessible Amazon Lambda function is open to the public and can be reviewed by anyone. To protect against unauthorized users that are sending requests to invoke these functions they need to be changed so they are not exposed to the public.
Allowing anyone to invoke and run your Amazon Lambda functions can lead to data exposure, data loss, and unexpected charges on your AWS bill.
Restricting public access may break existing integrations that rely on anonymous invocation of Lambda functions.
AWS Lambda, click Functions.Function name click on the name of the function that you want to reviewPermissions.Resource-based policy section, click View policy documentaws lambda list-functionsaws lambda list-functions --output table --query "Functions[*].FunctionName"
This command will provide a table titled ListFunctions
aws lambda get-policyaws lambda get-policy --function-name "name_of_function" --output text --query "Policy"
This will provide an output of the policy assigned to that function.
No Lambda function has a resource-based policy that allows anonymous or public access (Principal set to "" or {"AWS": ""} without a Condition clause).
AWS Lambda, click Functions.Function name click on the name of the function that you want to reviewPermissions.Resource-based policy section, perform the following actions:
aws lambda remove-permissionaws lambda remove-permission --function-name "name_of_function" --statement-id "SID_of_Statement"
This command will remove the access policy that is failing the audit for that function.
aws lambda add-permissionaws lambda add-permission --function-name "name_of_function" --statement-id "correctaccess" --principal "012345678910" --action lambda:InvokeFunction
This adds a new policy to the function.
***Note The --principal parameter can be the ID of the trusted AWS account, another AWS account, IAM user, IAM role, or another AWS service.
Lambda functions are not publicly accessible by default. Public access requires explicit configuration of resource-based policies.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 1.2 Address Unauthorized Assets - Ensure that a process exists to address unauthorized assets on a weekly basis. The enterprise may choose to remove the asset from the network, deny the asset from connecting remotely to the network, or quarantine the asset. | x | x | x |
| v7 | 1.6 Address Unauthorized Assets - Ensure that unauthorized assets are either removed from the network, quarantined or the inventory is updated in a timely manner. | x | x | x |
| v7 | 2.6 Address unapproved software - Ensure that unauthorized software is either removed or the inventory is updated in a timely manner. | x | x | x |
Level 1 | Manual