Rule: Lambda Functions Should Restrict Public Access

Rule Description:

Troubleshooting Steps (if applicable):

2. 1.

   Verify Lambda Function Configuration: Double-check the Lambda function's configuration settings to ensure that public access is appropriately restricted.

4. 2.

   Check Resource Policies: Examine the resource policies associated with the Lambda function to confirm that they are properly configured to restrict public access.

6. 3.

   Validate Network Access Controls: Ensure that the Lambda function is placed within the appropriate network environment, such as a Virtual Private Cloud (VPC) with appropriate access control lists (ACLs) and security groups.

8. 4.

   Review IAM Roles and Permissions: Verify that the IAM roles assigned to the Lambda function do not grant unnecessary public access permissions and are in accordance with the FFIEC requirements.

10. 5.

    Check VPC Endpoints: If the Lambda function requires access to specific resources within the VPC, validate that VPC endpoints are appropriately configured to allow secure communication with those resources.

12. 6.

    Lambda Function Testing: Perform test invocations of the Lambda function to verify that it functions correctly even with restricted public access.

Necessary Codes (if applicable):

import json
import boto3

def lambda_handler(event, context):
    # Restrict public access for FFIEC Lambda functions
    client = boto3.client('lambda')
    
    # List all existing functions
    response = client.list_functions()
    functions = response['Functions']
    
    # Loop through each function
    for function in functions:
        # Update function configuration to restrict public access
        response = client.update_function_configuration(
            FunctionName=function['FunctionName'],
            VpcConfig={
                'SecurityGroupIds': [],
                'SubnetIds': []
            }
        )
    
    return {
        'statusCode': 200,
        'body': json.dumps('Public access restricted for FFIEC Lambda functions')
    }

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": "lambda:InvokeFunction",
            "Resource": "*",
            "Condition": {
                "StringNotEquals": {
                    "aws:Referer": "ffiec-approved-referer"
                }
            }
        }
    ]
}

Step-by-Step Guide for Remediation:

2. 1.
   Open the AWS Management Console and navigate to the Lambda service.
4. 2.
   Identify the Lambda functions that need to comply with the rule. These functions should be associated with FFIEC resources or handle sensitive financial data.
6. 3.
   For each identified function, click on its name to access its configuration.
8. 4.
   In the "Configuration" tab, look for the "VPC" section and ensure that it is properly configured.

   • If the Lambda function does not require Internet access, remove any associated security groups and subnets to restrict public access:

     • Click on "Edit" in the "VPC" section.
     • Remove the security group associations under "Security groups".
     • Remove the subnet associations under "Subnets".
     • Click "Save" to apply the changes.
   • If the Lambda function requires access to specific resources within a VPC, validate that the associated security groups and subnets are appropriately configured:

     • Ensure that the security groups allow necessary inbound and outbound traffic.
     • Verify that the subnets have the required connectivity to the FFIEC resources.
     • Save any changes made.
10. 5.
    Review the IAM roles associated with the Lambda functions and ensure that they do not grant unnecessary public access permissions.

    • Edit the respective IAM roles if required and enforce the necessary restrictions.
12. 6.
    Validate the Network Access Controls (ACLs and security groups) within the VPC:

    • Ensure that the appropriate network access controls are in place to restrict public access to FFIEC Lambda functions.
14. 7.
    Perform thorough testing by invoking the Lambda functions to verify that they function correctly after restricting public access.
16. 8.
    Monitor the Lambda functions and associated logs to ensure that the restricted access does not impact their intended functionality.
18. 9.
    Regularly review and audit the Lambda functions to maintain compliance with the rule/policy and promptly address any identified issues.