Project: KICS (Provisioning / Security & Compliance)
File: 1b3af2f9-af8c-4dfc-a0f1-a03adb70deb2.md

title: Lambda Function With Privileged Role hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 1b3af2f9-af8c-4dfc-a0f1-a03adb70deb2 Query name: Lambda Function With Privileged Role Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: It is not advisable for AWS Lambda Functions to have privileged permissions.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="4 23" resource "awslambdafunction" "positivefunction1" { filename = "lambdafunctionpayload.zip" functionname = "lambdafunction_name" role = awsiamrole.positiverole1.arn handler = "exports.test" sourcecodehash = filebase64sha256("lambdafunctionpayload.zip") runtime = "nodejs12.x" tags = { Name = "lambda" } environment = { variables = { foo = "bar" } } } resource "awslambdafunction" "positivefunction2" { filename = "lambdafunctionpayload.zip" functionname = "lambdafunction_name" role = awsiamrole.positiverole2.arn handler = "exports.test" sourcecodehash = filebase64sha256("lambdafunctionpayload.zip") runtime = "nodejs12.x" tags = { Name = "lambda" } environment = { variables = { foo = "bar" } } } resource "awsiamrole" "positiverole1" { name = "positiverole1" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": ["some:action"], "Principal": { "Service": "lambda.amazonaws.com" }, "Effect": "Allow", "Resource": "*", "Sid": "" } ] } EOF tags = { tag-key = "tag-value" } } resource "awsiamrole" "positiverole2" { name = "positiverole2" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": ["some:action"], "Principal": { "Service": "lambda.amazonaws.com" }, "Effect": "Allow", "Resource": "*", "Sid": "" } ] } EOF tags = { tag-key = "tag-value" } } resource "awsiamrole_policy" "positiveinlinepolicy1" { name = "positiveinlinepolicy1" role = awsiamrole.positiverole1.id policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "ec2:Describe*", "iam:*" ] Effect = "Allow" Resource = "*" }, ] }) } resource "awsiampolicy" "positivecustomermanagedpolicy1" { name = "positivecustomermanagedpolicy1" policy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:Describe*", "sts:AssumeRole" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "iam:CreateLoginProfile" ], "Effect": "Allow", "Resource": "*" } ] } EOF } resource "awsiampolicy" "positivecustomermanagedpolicy2" { name = "positivecustomermanagedpolicy2" policy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:Describe*", "sts:AssumeRole" ], "Effect": "Allow", "Resource": "*" } ] } EOF } resource "awsiamrolepolicyattachment" "positiverolepolicyattachment1" { role = awsiamrole.positiverole1.name policyarn =

} resource "awsiampolicy_attachment" "positivedirectpolicyattachment1" { roles = [awsiamrole.positiverole1.name] policyarn = awsiam_policy.positivecustomermanagedpolicy2.arn } resource "awsiamrolepolicyattachment" "positiverolepolicyattachment2" { role = awsiamrole.positiverole2.name policy_arn = "arn:aws:iam::policy/positivepreexistingpolicyarn1" } resource "awsiampolicy_attachment" "positivedirectpolicyattachment2" { roles = [awsiamrole.positiverole2.name] policy_arn = "arn:aws:iam::policy/AmazonPersonalizeFullAccess" } ``` ```tf title="Negative test num. 1 - tf file" resource "awslambdafunction" "negativefunction1" { filename = "lambdafunctionpayload.zip" functionname = "lambdafunction_name" role = awsiamrole.negativerole1.arn handler = "exports.test" sourcecodehash = filebase64sha256("lambdafunctionpayload.zip") runtime = "nodejs12.x" tags = { Name = "lambda" } environment = { variables = { foo = "bar" } } } resource "awslambdafunction" "negativefunction2" { filename = "lambdafunctionpayload.zip" functionname = "lambdafunction_name" role = awsiamrole.negativerole2.arn handler = "exports.test" sourcecodehash = filebase64sha256("lambdafunctionpayload.zip") runtime = "nodejs12.x" tags = { Name = "lambda" } environment = { variables = { foo = "bar" } } } resource "awsiamrole" "negativerole1" { name = "negativerole1" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": ["some:action"], "Principal": { "Service": "lambda.amazonaws.com" }, "Effect": "Allow", "Resource": "*", "Sid": "" } ] } EOF tags = { tag-key = "tag-value" } } resource "awsiamrole" "negativerole2" { name = "negativerole2" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": ["some:action"], "Principal": { "Service": "lambda.amazonaws.com" }, "Effect": "Allow", "Resource": "*", "Sid": "" } ] } EOF tags = { tag-key = "tag-value" } } resource "awsiamrole_policy" "negativeinlinepolicy1" { name = "negativeinlinepolicy1" role = awsiamrole.negativerole1.id policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "ec2:Describe*", "s3:GetObject" ] Effect = "Allow" Resource = "*" }, ] }) } resource "awsiampolicy" "negativecustomermanagedpolicy1" { name = "negativecustomermanagedpolicy1" policy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } EOF } resource "awsiampolicy" "negativecustomermanagedpolicy2" { name = "negativecustomermanagedpolicy2" policy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": [ "lambda:CreateFunction" ], "Effect": "Allow", "Resource": "*" } ] } EOF } resource "awsiamrolepolicyattachment" "negativerolepolicyattachment1" { role = awsiamrole.negativerole1.name policyarn = awsiam_policy.negativecustomermanagedpolicy1.arn } resource "awsiampolicy_attachment" "negativedirectpolicyattachment1" { roles = [awsiamrole.negativerole1.name] policyarn = awsiam_policy.negativecustomermanagedpolicy2.arn } resource "awsiamrolepolicyattachment" "negativerolepolicyattachment2" { role = awsiamrole.negativerole2.name policy_arn = "arn:aws:iam::policy/negativepreexistingpolicyarn1" } resource "awsiampolicy_attachment" "negativedirectpolicyattachment2" { roles = [awsiamrole.negativerole2.name] policy_arn = "arn:aws:iam::policy/DenyAll" } ```