AWS Lambda function is not configured for a DLQ misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_116
Category - Subcategory	Compute - Unsanctioned Resource Or Type
Provider	AWS
Severity	LOW
Framework	CloudFormation, Serverless, Terraform, Terraform Plan

Impact

Setting up a DLQ offers the possibility to investigate errors or failed requests to the connected Lambda function. As an alternative it is possible to configure an on-failure destination target, which forwards a failed event to a DLQ, SNS Topic, Lambda function or EventBridge. It is always important to understand why your application/function failed and to ensure that no data was dropped or compromised. Lambda functions are often used to process security related data like CloudTrail events and a failed delivery to a dependent system can result in an unnoticed security breach.

How to Fix

Resource: AWS::Lambda::Function

• Arguments: Properties.DeadLetterConfig [source,go]

---

Type: AWS::Lambda::Function Properties: ...

• DeadLetterConfig:
• TargetArn: "test"

---