Ensure that Lambda Function resource-based policy doesn't have excessive permissions (Contains a wildcard)

Determine the specific resource-based permissions needed by your Lambda Functions, and then craft a resource-based policy for these permissions only.

Risk Level: High
Cloud Entity: AWS Lambda
CloudGuard Rule ID: D9.AWS.IAM.104
Category: Compute


Lambda should not have resourcePolicy.Statement contain [ Effect='Allow' and (Action contain [$ regexMatch /\*/] or Action regexMatch /\*/) ]


From Portal

  1. Go to 'Lambda' dashboard
  2. In the left menu, select 'Functions'
  3. Select the relevant Lambda Function
  4. Under 'Configurations', go to 'Permissions'
  5. Under 'Resource-based policy statements', select the relevant statement
  6. Edit the statement according to the principle of least privilege

From TF
To edit a resource-based policy, edit the 'action' attribute within 'aws_lambda_permission' block:

resource "aws_lambda_permission" "lambda_permission_example" {
	action = ACTION

From Command Line
To remove a resource-based policy statement from a Lambda Function, run:

aws lambda remove-permission --function-name FUNCTION-NAME --statement-id STATEMENT-ID

To apply a resource-based policy statement to a Lambda Function, run:

aws lambda add-permission --function-name FUNCTION-NAME--action ACTION --statement-id STATEMENT-ID --principal PRINCIPAL


  1. https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html
  2. https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission
  3. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lambda/remove-permission.html
  4. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lambda/add-permission.html

AWS Lambda

AWS Lambda lets you run code without provisioning or managing servers. You pay only for the compute time you consume - there is no charge when your code is not running.

With Lambda, you can run code for virtually any type of application or backend service - all with zero administration. Just upload your code and Lambda takes care of everything required to run and scale your code with high availability. You can set up your code to automatically trigger from other AWS services or call it directly from any web or mobile app.

Compliance Frameworks

  • AWS CloudGuard Best Practices
  • AWS CloudGuard SOC2 based on AICPA TSC 2017
  • AWS HITRUST v11.0.0
  • AWS PCI-DSS 4.0
  • AWS Security Risk Management