Lambda functions should not be configured with a privileged execution role

문서 > Datadog 보안 > OOTB Rules > Lambda functions should not be configured with a privileged execution role

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Description

This control ensures that none of your Lambda functions are attached to a highly-privileged execution role. Reducing privileges for these roles minimizes security risks and potential vulnerabilities in your AWS environment.

Note: Lambda execution roles are the preferred way to grant Lambda functions access to AWS APIs. However, associating a function with a privileged IAM role is risky because an attacker, exploiting an application-level vulnerability, could compromise your entire AWS account.

Remediation

Lambda functions typically do not require privileged IAM roles. It is recommended to reduce the permissions attached to the execution role. You can use AWS Access Advisor to identify the effective permissions used by your Lambda functions and use AWS IAM Access Analyzer to generate an IAM policy based on past CloudTrail events.