Cis AWS Compute 12.5

Ensure every Lambda function has its own IAM Role

Description

Every Lambda function should have a one to one IAM execution role and the roles should not be shared between functions.

Rationale

The Principle of Least Privilege means that any Lambda function should have the minimal amount of access required to perform its tasks. In order to accomplish this Lambda functions should not share IAM Execution roles.

Impact

Creating unique IAM roles for each Lambda function increases the number of IAM roles to manage but provides better security isolation between functions.

Audit Procedure

Using AWS Console

1. Login to the AWS console using https://console.aws.amazon.com/lambda/
2. In the left column, under AWS Lambda, click Functions.
3. Under Function name click on the name of the function that you want to review.
4. Click the Configuration tab
5. Under General configuration on the left column, click Permissions.
6. Under the Execution role section, Role name not the name listed as this is the IAM is the role that defines the access permissions for the selected function.
7. Repeat steps 2 - 6 for all the Lambda functions listed within the AWS region.
8. If any Lambda functions share the same Execution role, refer to the remediation below.
9. Repeat this Audit for all the AWS Regions.

Using AWS CLI

N/A - This control is Console-based audit only.

Expected Result

Each Lambda function has a unique IAM execution role that is not shared with any other Lambda function.

Remediation

Using AWS Console

1. Login to the AWS console using https://console.aws.amazon.com/lambda/
2. In the left column, under AWS Lambda, click Functions.
3. Under Function name click on the name of the function that you want to change/update.
4. Click the Configuration tab
5. Under General configuration on the left column, click Permissions.
6. Under the Execution role section, click Edit.
7. Scroll down to Execution role

To use an existing IAM role:

• Click Use an existing role
• Select the role from the Existing role dropdown.
• The IAM role can't be associated with another Lambda function and must follow the Principle of Least Privilege.

To use a new IAM role:

• Click Create a new role from AWS policy templates
• Provide a unique name based on company policy in the Role name
• Select the policy templates from the Policy templates dropdown.

8. Click Save
9. Repeat steps 2 - 8 for all the Lambda functions listed within the AWS region that do not have a unique IAM Execution Role.
10. Repeat this remediation process for all the AWS Regions.

Using AWS CLI

N/A - This control is Console-based remediation only.

Default Value

When creating a Lambda function, AWS creates a default execution role, but multiple functions can be configured to share the same role.

References

1. https://docs.aws.amazon.com/lambda/latest/dg/welcome.html

CIS Controls

Profile

Level 1 | Manual