> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec2-aws-75.md).

# AWS Lambda function URL having overly permissive cross-origin resource sharing permissions misconfig

## Rule Details

|                       |                                           |
| --------------------- | ----------------------------------------- |
| Cortex AppSec Rule ID | APPSEC2\_AWS\_75                          |
| Category              | Networking                                |
| Provider              | AWS                                       |
| Severity              | MEDIUM                                    |
| Framework             | CloudFormation, Terraform, Terraform Plan |
| Mapped CSPM/KSPM Rule | c7ce78c7-5412-43f0-ae9c-c90410957502      |

## Impact

AWS Lambda functions with overly permissive CORS configurations expose sensitive data and functionality to unauthorized access. Improperly configured CORS settings, specifically using wildcard characters in 'allowOrigins', enable any origin to invoke the function.

Lambda functions act as crucial components in serverless architectures. Misconfiguration of CORS settings allows malicious actors to send unauthorized requests, potentially leading to data breaches, denial-of-service attacks, or exploitation of the function's logic via cross-site scripting. This undermines the security of your application and its associated data.

The impact of this misconfiguration is significant, potentially resulting in unauthorized data access, application logic manipulation, and service disruption. Restricting CORS configuration to specific origins and HTTP methods ensures that only legitimate clients can interact with the Lambda function, mitigating these risks.

To remediate, configure Lambda function CORS settings to explicitly list allowed origins ('allowOrigins') and HTTP methods ('allowMethods'). Avoid using wildcard characters. Regularly review and update these settings as your application's access needs change. Employ least privilege principles in configuring your Lambda function's access control.

## How to Fix

## To ensure that no open CORS policy is applied to your S3 buckets, configure the `cors_rule`. Set appropriate allowed origins, allowed methods, and other parameters to restrict access as necessary. \[source,go]

Example: Type: AWS::Lambda::Function Properties: ...

Example: Type: AWS::Lambda::Url Properties: FunctionName: !Ref Example Cors: AllowOrigins:

* * "\*"
* * <https://example.com> AllowMethods:
* * "\*"
* * GET ServiceToken: "arn:aws:lambda:us-west-2:123456789012:function:dummy-token"

***


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec2-aws-75.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.