All checks
Critical
Lambda function policies should prohibit public access
Verifies that Lambda function resource-based policies do not grant public access from outside the account, which would let anyone use the function. The statements Lambda adds for a function URL with auth type NONE fail, and a grant to Amazon S3 counts as public unless a condition pins it to your account or to the bucket that invokes it.
- service
- Lambda
- severity
- Critical
- scope
- evaluated in every region
How to fix it
- Can break clients: With its public statements removed, a function URL refuses every call with 403 Forbidden, even while its auth type is NONE.
In the console
Lambda → Functions → the function → Configuration → Permissions → Resource-based policy statements
- Principal
- Named accounts, roles or services, never "*"; s3.amazonaws.com only with a condition naming your account or bucket
- Condition
- Keep "*" only with a fixed aws:SourceAccount, aws:PrincipalOrgID, aws:SourceArn or aws:SourceVpce; not aws:SourceIp
- Resource-based policy statements
- Remove every public one, including those a NONE function URL adds, which stay after the URL is deleted
- Statement ID
- Read it from the current policy (aws lambda get-policy); the finding does not carry it
- Auth type
- AWS_IAM, under Configuration → Function URL, if named callers still need the URL; grant each by name
With the AWS CLI
aws lambda remove-permission --function-name <function-name> --statement-id <statement-id> --region <region>See which of your accounts this check is failing on.
Book a live scan