Project: KICS (Provisioning / Security & Compliance)
File: 0ca1017d-3b80-423e-bb9c-6cd5898d34bd.md

title: Lambda IAM InvokeFunction Misconfigured hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 0ca1017d-3b80-423e-bb9c-6cd5898d34bd Query name: Lambda IAM InvokeFunction Misconfigured Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Best Practices URL: Lambda permission may be misconfigured if the action field is not filled in by 'lambda:InvokeFunction'<br> ```tf title="Positive test num. 1 - tf file" hl_lines="8" resource "awsiampolicy" "positive1policy" { name = "positive1policy" path = "/" description = "Positive1 Policy" policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "lambda:InvokeFunction", ] Effect = "Allow" Resource = [ "arn:aws:lambda:::function:positive1" ] }, ] }) } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="8" resource "awsiampolicy" "positive2policy" { name = "positive2policy" path = "/" description = "Positive2 Policy" policy = jsonencode({ Version = "2022-20-27" Statement = [ { Action = [ "lambda:InvokeFunction", ] Effect = "Allow" Resource = [ "arn:aws:lambda:::function:positive2:" ] }, ] }) } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="8" resource "awsiampolicy" "positive3policy" { name = "positive3policy" path = "/" description = "positive3 Policy" policy = jsonencode({ Version = "2022-20-27" Statement = [ { Action = [ "lambda:InvokeFunction", ] Effect = "Allow" Resource = [ "arn:aws:lambda:::function::" ] }, ] }) } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="5" resource "awsiampolicy" "positive4policy" { name = "positive4policy" path = "/" description = "positive4 Policy" policy = data.awsiampolicy_document.datapositive4policy.json } data "awsiampolicy_document" "datapositive4policy" { statement { effect = "Allow" actions = [ "lambda:InvokeFunction" ] resources = [ "arn:aws:lambda:::function::" ] } } ``` </details> <details><summary>Positive test num. 5 - tf file</summary> ```tf hl_lines="8" resource "awsiampolicy" "positive5policy" { name = "positive5policy" path = "/" description = "positive5 Policy" policy = jsonencode({ Version = "2022-20-27" Statement = [ { Action = [ "*", ] Effect = "Allow" Resource = [ "arn:aws:lambda:::function::" ] }, ] }) } ``` </details> <details><summary>Positive test num. 6 - tf file</summary> ```tf hl_lines="8" resource "awsiampolicy" "positive6policy" { name = "positive6policy" path = "/" description = "positive6 Policy" policy = jsonencode({ Version = "2022-20-27" Statement = [ { Action = [ "lambda:*", ] Effect = "Allow" Resource = [ "arn:aws:lambda:::function::" ] }, ] }) } ``` </details> ```tf title="Negative test num. 1 - tf file" resource "awsiampolicy" "negative1policy" { name = "negative1policy" path = "/" description = "negative1 Policy" policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "lambda:InvokeFunction", ] Effect = "Allow" Resource = [ "arn:aws:lambda:::function:negative1", "arn:aws:lambda:::function:negative1:*" ] }, ] }) } ``` ```tf title="Negative test num. 2 - tf file" resource "awsiampolicy" "negative2policy" { name = "negative2policy" path = "/" description = "negative2 Policy" policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "s3:*", ] Effect = "Allow" Resource = ["*"] }, ] }) } ``` ```tf title="Negative test num. 3 - tf file" resource "awslambdafunction" "negative3" { function_name = "negative3" role = "negative3_role" } resource "awsiampolicy" "negative3policy" { name = "negative3policy" path = "/" description = "negative3 Policy" policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "s3:*", ] Effect = "Allow" Resource = [ awslambdafunction.negative3.arn, "${awslambdafunction.negative3.arn}:*" ] }, ] }) } ```