Permissions delegated to AWS services for AWS Lambda functions are not limited by SourceArn or Sourc

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_364
Category - Subcategory	IAM - Overly Permissive
Provider	AWS
Severity	HIGH
Framework	CloudFormation, Terraform, Terraform Plan

Impact

This rule ensures that AWS Lambda function permissions delegated to AWS services are restricted by SourceArn or SourceAccount. This helps prevent unauthorized access and limits the scope of permissions granted to Lambda functions.

How to Fix

To mitigate this issue, ensure that the AWS::Lambda::Permission resource includes the SourceArn or SourceAccount property to limit the permissions delegated to AWS services.

Example: [source,go]

{ "Resources": { "MyLambdaPermission": { "Type": "AWS::Lambda::Permission", "Properties": { "Action": "lambda:InvokeFunction", "FunctionName": "MyFunction", "Principal": "sns.amazonaws.com",

• "SourceArn": "arn:aws:sns:us-east-1:123456789012:MyTopic" } } } }

---

Resources: MyLambdaPermission: Type: AWS::Lambda::Permission Properties: Action: lambda:InvokeFunction FunctionName: MyFunction Principal: sns.amazonaws.com

• SourceArn: arn:aws:sns:us-east-1:123456789012:MyTopic

---