用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-compute-12-6命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | cis-aws-compute-12.6 |
| description | Ensure Lambda functions are not exposed to everyone |
| category | cis-compute |
| version | 1.1.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","compute","lambda","serverless","public-access","permissions","resource-policy"] |
| cis_id | 12.6 |
| cis_benchmark | CIS AWS Compute Services Benchmark v1.1.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-compute-12.4","cis-aws-compute-12.9","cis-aws-compute-12.10"] |
| prerequisites | [] |
| severity_boost | {} |
A publicly accessible Amazon Lambda function is open to the public and can be reviewed by anyone. To protect against unauthorized users that are sending requests to invoke these functions they need to be changed so they are not exposed to the public.
Allowing anyone to invoke and run your Amazon Lambda functions can lead to data exposure, data loss, and unexpected charges on your AWS bill.
Restricting public access may break existing integrations that rely on anonymous invocation of Lambda functions.
AWS Lambda, click Functions.Function name click on the name of the function that you want to reviewPermissions.Resource-based policy section, click View policy documentaws lambda list-functionsaws lambda list-functions --output table --query "Functions[*].FunctionName"
This command will provide a table titled ListFunctions
aws lambda get-policyaws lambda get-policy --function-name "name_of_function" --output text --query "Policy"
This will provide an output of the policy assigned to that function.
No Lambda function has a resource-based policy that allows anonymous or public access (Principal set to "" or {"AWS": ""} without a Condition clause).
AWS Lambda, click Functions.Function name click on the name of the function that you want to reviewPermissions.Resource-based policy section, perform the following actions:
aws lambda remove-permissionaws lambda remove-permission --function-name "name_of_function" --statement-id "SID_of_Statement"
This command will remove the access policy that is failing the audit for that function.
aws lambda add-permissionaws lambda add-permission --function-name "name_of_function" --statement-id "correctaccess" --principal "012345678910" --action lambda:InvokeFunction
This adds a new policy to the function.
***Note The --principal parameter can be the ID of the trusted AWS account, another AWS account, IAM user, IAM role, or another AWS service.
Lambda functions are not publicly accessible by default. Public access requires explicit configuration of resource-based policies.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 1.2 Address Unauthorized Assets - Ensure that a process exists to address unauthorized assets on a weekly basis. The enterprise may choose to remove the asset from the network, deny the asset from connecting remotely to the network, or quarantine the asset. | x | x | x |
| v7 | 1.6 Address Unauthorized Assets - Ensure that unauthorized assets are either removed from the network, quarantined or the inventory is updated in a timely manner. | x | x | x |
| v7 | 2.6 Address unapproved software - Ensure that unauthorized software is either removed or the inventory is updated in a timely manner. | x | x | x |
Level 1 | Manual