Rule: Lambda functions should restrict public access

Rule Description

Troubleshooting Steps

2. 1.
   Check Lambda Function Configuration: Review the configuration settings of the Lambda function to ensure that public access is restricted.
4. 2.
   Check Function Permissions: Verify the IAM permissions and roles assigned to the Lambda function to ensure that public access is denied.
6. 3.
   Verify Execution Role: Ensure that the execution role assigned to the function does not have any policies allowing public access.
8. 4.
   Review Network Configuration: Review the VPC and subnets associated with the Lambda function to ensure that it is not publicly accessible.
10. 5.
    Check Security Group Rules: Validate the security group rules associated with the Lambda function to ensure that inbound access from the internet is restricted.

Necessary Code

Resources:
  MyLambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: MyFunction
      Role: !Ref MyLambdaExecutionRole
      Code:
        S3Bucket: my-lambda-bucket
        S3Key: lambda-function.zip
      Handler: index.handler
      Runtime: nodejs12.x
      VpcConfig:
        SecurityGroupIds:
          - sg-xxxxxxxx
        SubnetIds:
          - subnet-xxxxxxxx
          - subnet-xxxxxxxx

Remediation Steps

2. 1.
   Identify Lambda Functions: Identify the Lambda functions that require public access restriction.
4. 2.
   Review Function Configuration: Review the configuration settings of each Lambda function to identify any existing public access.
6. 3.
   Associate Lambda Functions with VPC: If not already done, associate the Lambda functions with a Virtual Private Cloud (VPC) to restrict public access.
8. 4.
   Create VPC Security Group: Create a security group in the VPC that will control the inbound and outbound traffic for the Lambda functions.
10. 5.
    Add Security Group Rules: Configure the security group rules to only allow necessary inbound connections (e.g., from specific IP ranges or internal services). Deny all inbound access from the internet.
12. 6.
    Associate Subnets: Associate the desired subnets within the VPC to the Lambda functions to limit network access to within the VPC.
14. 7.
    Update Function Configuration: Update the Lambda function configuration to include the VPC configuration (as shown in the necessary code snippet above).
16. 8.
    Test Function Access: Test the Lambda functions to ensure they are no longer publicly accessible and verify that they still function as expected.
18. 9.
    Periodic Review: Regularly review and audit Lambda functions to ensure ongoing compliance with the public access restriction policy.