用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-compute-12-9命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | cis-aws-compute-12.9 |
| description | Ensure there are no Lambda functions with admin privileges within your AWS account |
| category | cis-compute |
| version | 1.1.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","compute","lambda","serverless","iam","admin-privileges","least-privilege","over-permission"] |
| cis_id | 12.9 |
| cis_benchmark | CIS AWS Compute Services Benchmark v1.1.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-compute-12.4","cis-aws-compute-12.5","cis-aws-compute-12.10"] |
| prerequisites | [] |
| severity_boost | {} |
Ensure that your Amazon Lambda functions don't have administrative permissions potentially giving the function access to all AWS cloud services and resources.
In order to promote the Principle of Least Privilege (POLP) and provide your functions the minimal amount of access required to perform their tasks the right IAM execution role associated with the function should be used. Instead of providing administrative permissions you should grant the role the necessary permissions that the function really needs.
Removing admin privileges from Lambda execution roles may break functions that rely on broad permissions. Functions should be tested after permission changes.
AWS Lambda, click Functions.Function name click on the name of the function that you want to reviewPermissions in the left column.Role name to access the IAM role details.
**Note this will bring you to the IAM Console.If one or more policies allow access to all AWS services and resources, the execution role provides administrative permissions. Refer to the remediation below. Repeat steps for each Lambda function within the current region. Then repeat the Audit process for all other regions.
N/A - This control requires manual review of IAM policies through the Console.
No Lambda function execution role has policies with "Action": "*" and "Effect": "Allow", ensuring no function has administrative privileges.
AWS Lambda, click Functions.Function name click on the name of the function you want to remediatePermissions in the left column.EditAssociate the function with an existing, compliant IAM role:
OR apply a new execution role to your Lambda function:
N/A - This control is Console-based remediation only.
Lambda functions are not created with administrative privileges by default, but users may attach overly permissive policies to execution roles.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 6.8 Define and Maintain Role-Based Access Control - Define and maintain role-based access control, through determining and documenting the access rights necessary for each role within the enterprise to successfully carry out its assigned duties. Perform access control reviews of enterprise assets to validate that all privileges are authorized, on a recurring schedule at a minimum annually, or more frequently. | x | ||
| v7 | 1.7 Deploy Port Level Access Control - Utilize port level access control, following 802.1x standards, to control which devices can authenticate to the network. | x | x |
Level 1 | Manual