Project: KICS (Provisioning / Security & Compliance)
File: 4ba74f01-aba5-4be2-83bc-be79ff1a3b92.md

title: Serverless Function Without Unique IAM Role hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 4ba74f01-aba5-4be2-83bc-be79ff1a3b92 Query name: Serverless Function Without Unique IAM Role Platform: CloudFormation Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: AWS Serverless Function should not share IAM Role to ensure it will have the minimum privileges needed to perform the required tasks<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="34 19" AWSTemplateFormatVersion: '2010-09-09' Transform: AWS::Serverless-2016-10-31 Description: AWS SAM template with a simple API definition Resources: Function1: Type: AWS::Serverless::Function Properties: PackageType: Image ImageUri: account-id.dkr.ecr.region.amazonaws.com/ecr-repo-name:image-name ImageConfig: Command: "app.lambda_handler" EntryPoint: "entrypoint1" WorkingDirectory: "workDir" Tags: Key: Type Value: AWS Serverless Function Role: arn:aws:iam::123456789012:role/lambda-role Function2: Type: AWS::Serverless::Function Properties: PackageType: Image ImageUri: account-id.dkr.ecr.region.amazonaws.com/ecr-repo-name:image-name ImageConfig: Command: "app.lambda_handler" EntryPoint: "entrypoint1" WorkingDirectory: "workDir" Tags: Key: Type Value: AWS Serverless Function Role: arn:aws:iam::123456789012:role/lambda-role ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="34 19" AWSTemplateFormatVersion: '2010-09-09' Transform: AWS::Serverless-2016-10-31 Description: AWS SAM template with a simple API definition Resources: Function1: Type: AWS::Serverless::Function Properties: PackageType: Image ImageUri: account-id.dkr.ecr.region.amazonaws.com/ecr-repo-name:image-name ImageConfig: Command: "app.lambda_handler" EntryPoint: "entrypoint1" WorkingDirectory: "workDir" Tags: Key: Type Value: AWS Serverless Function Role: !Ref Role Function2: Type: AWS::Serverless::Function Properties: PackageType: Image ImageUri: account-id.dkr.ecr.region.amazonaws.com/ecr-repo-name:image-name ImageConfig: Command: "app.lambda_handler" EntryPoint: "entrypoint1" WorkingDirectory: "workDir" Tags: Key: Type Value: AWS Serverless Function Role: !Ref Role ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: '2010-09-09' Transform: AWS::Serverless-2016-10-31 Description: AWS SAM template with a simple API definition Resources: Function3: Type: AWS::Serverless::Function Properties: PackageType: Image ImageUri: account-id.dkr.ecr.region.amazonaws.com/ecr-repo-name:image-name ImageConfig: Command: "app.lambda_handler" EntryPoint: "entrypoint1" WorkingDirectory: "workDir" Tags: Key: Type Value: AWS Serverless Function Role: arn:aws:iam::123456789012:role/lambda-role ``` ```yaml title="Negative test num. 2 - yaml file" AWSTemplateFormatVersion: '2010-09-09' Transform: AWS::Serverless-2016-10-31 Description: AWS SAM template with a simple API definition Resources: Function1: Type: AWS::Serverless::Function Properties: PackageType: Image ImageUri: account-id.dkr.ecr.region.amazonaws.com/ecr-repo-name:image-name ImageConfig: Command: "app.lambda_handler" EntryPoint: "entrypoint1" WorkingDirectory: "workDir" Tags: Key: Type Value: AWS Serverless Function Role: !Ref Role2 Function2: Type: AWS::Serverless::Function Properties: PackageType: Image ImageUri: account-id.dkr.ecr.region.amazonaws.com/ecr-repo-name:image-name ImageConfig: Command: "app.lambda_handler" EntryPoint: "entrypoint1" WorkingDirectory: "workDir" Tags: Key: Type Value: AWS Serverless Function Role: !Ref Role4 ```