Project: KICS (Provisioning / Security & Compliance)
File: a0ae0a4e-712b-4115-8112-51b9eeed9d69.md

title: Lambda Functions With Full Privileges hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: a0ae0a4e-712b-4115-8112-51b9eeed9d69 Query name: Lambda Functions With Full Privileges Platform: CloudFormation Severity: <span style="color:#bb2124">High</span> Category: Access Control URL: AWS Lambda Functions should not have roles with policies granting full administrative privileges.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="76" AWSTemplateFormatVersion: '2010-09-09' Parameters: ExistingSecurityGroups: Type: List<AWS::EC2::SecurityGroup::Id> ExistingVPC: Type: AWS::EC2::VPC::Id Description: The VPC ID that includes the security groups in the ExistingSecurityGroups parameter. InstanceType: Type: String Default: t2.micro AllowedValues: t2.micro m1.small Resources: SecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Allow HTTP traffic to the host VpcId: Ref: ExistingVPC SecurityGroupIngress: IpProtocol: tcp FromPort: '80' ToPort: '80' CidrIp: 0.0.0.0/0 SecurityGroupEgress: IpProtocol: tcp FromPort: '80' ToPort: '80' CidrIp: 0.0.0.0/0 AllSecurityGroups: Type: Custom::Split Properties: ServiceToken: !GetAtt AppendItemToListFunction.Arn List: Ref: ExistingSecurityGroups AppendedItem: Ref: SecurityGroup AppendItemToListFunction: Type: AWS::Lambda::Function Properties: Handler: index.handler Role: !GetAtt LambdaExecutionRole.Arn Code: ZipFile: | var response = require('cfn-response'); exports.handler = function(event, context) { var responseData = {Value: event.ResourceProperties.List}; responseData.Value.push(event.ResourceProperties.AppendedItem); response.send(event, context, response.SUCCESS, responseData); }; Runtime: nodejs8.10 MyEC2Instance: Type: AWS::EC2::Instance Properties: ImageId: ami-0ff8a91507f77f867 SecurityGroupIds: !GetAtt AllSecurityGroups.Value InstanceType: Ref: InstanceType LambdaExecutionRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Version: '2012-10-17' Statement: Effect: Allow Principal: Service: lambda.amazonaws.com Action: sts:AssumeRole Path: "/" Policies: PolicyName: root PolicyDocument: Version: '2012-10-17' Statement: Effect: Allow Action: "*" Resource: arn:aws:logs:::* ``` ```json title="Positive test num. 2 - json file" hl_lines="101" { "AWSTemplateFormatVersion": "2010-09-09", "Parameters": { "InstanceType": { "Default": "t2.micro", "AllowedValues": [ "t2.micro", "m1.small" ], "Type": "String" }, "ExistingSecurityGroups": { "Type": "List\u003cAWS::EC2::SecurityGroup::Id\u003e" }, "ExistingVPC": { "Description": "The VPC ID that includes the security groups in the ExistingSecurityGroups parameter.", "Type": "AWS::EC2::VPC::Id" } }, "Resources": { "SecurityGroup": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "Allow HTTP traffic to the host", "VpcId": { "Ref": "ExistingVPC" }, "SecurityGroupIngress": [ { "FromPort": "80", "ToPort": "80", "CidrIp": "0.0.0.0/0", "IpProtocol": "tcp" } ], "SecurityGroupEgress": [ { "IpProtocol": "tcp", "FromPort": "80", "ToPort": "80", "CidrIp": "0.0.0.0/0" } ] } }, "AllSecurityGroups": { "Type": "Custom::Split", "Properties": { "ServiceToken": "AppendItemToListFunction.Arn", "List": { "Ref": "ExistingSecurityGroups" }, "AppendedItem": { "Ref": "SecurityGroup" } } }, "AppendItemToListFunction": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "ZipFile": "var response = require('cfn-response');\nexports.handler = function(event, context) {\n var responseData = {Value: event.ResourceProperties.List};\n responseData.Value.push(event.ResourceProperties.AppendedItem);\n response.send(event, context, response.SUCCESS, responseData);\n};\n" }, "Runtime": "nodejs8.10", "Handler": "index.handler", "Role": "LambdaExecutionRole.Arn" } }, "MyEC2Instance": { "Type": "AWS::EC2::Instance", "Properties": { "ImageId": "ami-0ff8a91507f77f867", "SecurityGroupIds": "AllSecurityGroups.Value", "InstanceType": { "Ref": "InstanceType" } } }, "LambdaExecutionRole": { "Properties": { "AssumeRolePolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": [

] }, "Action": [ "sts:AssumeRole" ] } ] }, "Path": "/", "Policies": [ { "PolicyName": "root", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "*" ], "Resource": "arn:aws:logs:::*" } ] } } ] }, "Type": "AWS::IAM::Role" } } } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: '2010-09-09' Parameters: ExistingSecurityGroups: Type: List<AWS::EC2::SecurityGroup::Id> ExistingVPC: Type: AWS::EC2::VPC::Id Description: The VPC ID that includes the security groups in the ExistingSecurityGroups parameter. InstanceType: Type: String Default: t2.micro AllowedValues: t2.micro m1.small Resources: SecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Allow HTTP traffic to the host VpcId: Ref: ExistingVPC SecurityGroupIngress: IpProtocol: tcp FromPort: '80' ToPort: '80' CidrIp: 0.0.0.0/0 SecurityGroupEgress: IpProtocol: tcp FromPort: '80' ToPort: '80' CidrIp: 0.0.0.0/0 AllSecurityGroups: Type: Custom::Split Properties: ServiceToken: !GetAtt AppendItemToListFunction.Arn List: Ref: ExistingSecurityGroups AppendedItem: Ref: SecurityGroup AppendItemToListFunction: Type: AWS::Lambda::Function Properties: Handler: index.handler Role: !GetAtt LambdaExecutionRole.Arn Code: ZipFile: | var response = require('cfn-response'); exports.handler = function(event, context) { var responseData = {Value: event.ResourceProperties.List}; responseData.Value.push(event.ResourceProperties.AppendedItem); response.send(event, context, response.SUCCESS, responseData); }; Runtime: nodejs8.10 MyEC2Instance: Type: AWS::EC2::Instance Properties: ImageId: ami-0ff8a91507f77f867 SecurityGroupIds: !GetAtt AllSecurityGroups.Value InstanceType: Ref: InstanceType LambdaExecutionRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Version: '2012-10-17' Statement: Effect: Allow Principal: Service: lambda.amazonaws.com Action: sts:AssumeRole Path: "/" Policies: PolicyName: root PolicyDocument: Version: '2012-10-17' Statement: Effect: Allow Action: iam:ChangePassword Resource: arn:aws:iam::account-ID-without-hyphens:user/Bob ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Parameters": { "ExistingSecurityGroups": { "Type": "List\u003cAWS::EC2::SecurityGroup::Id\u003e" }, "ExistingVPC": { "Description": "The VPC ID that includes the security groups in the ExistingSecurityGroups parameter.", "Type": "AWS::EC2::VPC::Id" }, "InstanceType": { "Type": "String", "Default": "t2.micro", "AllowedValues": [ "t2.micro", "m1.small" ] } }, "Resources": { "SecurityGroup": { "Properties": { "GroupDescription": "Allow HTTP traffic to the host", "VpcId": { "Ref": "ExistingVPC" }, "SecurityGroupIngress": [ { "FromPort": "80", "ToPort": "80", "CidrIp": "0.0.0.0/0", "IpProtocol": "tcp" } ], "SecurityGroupEgress": [ { "IpProtocol": "tcp", "FromPort": "80", "ToPort": "80", "CidrIp": "0.0.0.0/0" } ] }, "Type": "AWS::EC2::SecurityGroup" }, "AllSecurityGroups": { "Type": "Custom::Split", "Properties": { "ServiceToken": "AppendItemToListFunction.Arn", "List": { "Ref": "ExistingSecurityGroups" }, "AppendedItem": { "Ref": "SecurityGroup" } } }, "AppendItemToListFunction": { "Type": "AWS::Lambda::Function", "Properties": { "Handler": "index.handler", "Role": "LambdaExecutionRole.Arn", "Code": { "ZipFile": "var response = require('cfn-response');\nexports.handler = function(event, context) {\n var responseData = {Value: event.ResourceProperties.List};\n responseData.Value.push(event.ResourceProperties.AppendedItem);\n response.send(event, context, response.SUCCESS, responseData);\n};\n" }, "Runtime": "nodejs8.10" } }, "MyEC2Instance": { "Type": "AWS::EC2::Instance", "Properties": { "ImageId": "ami-0ff8a91507f77f867", "SecurityGroupIds": "AllSecurityGroups.Value", "InstanceType": { "Ref": "InstanceType" } } }, "LambdaExecutionRole": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": [ "lambda.amazonaws.com" ] }, "Action": [ "sts:AssumeRole" ] } ] }, "Path": "/", "Policies": [ { "PolicyName": "root", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:ChangePassword" ], "Resource": "arn:aws:iam::account-ID-without-hyphens:user/Bob" } ] } } ] } } } } ```