Policy Packs

guardrails-samples

Prevent unauthorized users from invoking functions, which can lead to security vulnerabilities and potential data breaches.

Enforce AWS Lambda Functions Restrict Public Access

main

aws_lambda_function_policy_trusted_access

Take an action when AWS Lambda function policy is not trusted based on the&#92;n`AWS &gt; Lambda &gt; Function &gt; Policy &gt; Trusted Access &gt; *` policies.&#92;n&#92;nThe Trusted Access control evaluates the function policy against the list of allowed&#92;nmembers in each of the Trusted Access sub-policies (Trusted Access &gt; Accounts,&#92;nTrusted Access &gt; Services etc.), this control raises an alarm and takes the&#92;ndefined enforcement action.&#92;n&#92;nThe account that owns the function will always be trusted, even if its account ID is&#92;nnot included in the Trusted Accounts policy.&#92;n&#92;nIf set to `Enforce: Revoke untrusted access`, access to non-trusted&#92;nmembers will be removed.&#92;n

functionPolicyTrustedAccess

AWS > Lambda > Function > Policy > Trusted Access

aws_lambda_function_policy_trusted_access_accounts

List of AWS Account IDs that are trusted for cross-account access in the&#92;nAWS Lambda function policy.&#92;n&#92;nNote that `Trusted Access &gt; Accounts` and `Trusted Access &gt;&#92;nOrganizations` are evaluated independently. To have access, an AWS&#92;nprincipal must be allowed in `Trusted Access &gt; Accounts` AND be a&#92;nmember of an Organization that is allowed in `Trusted Access &gt;&#92;nOrganizations`.&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;123456789012&quot;&#92;n```&#92;n**Note**: Setting the policy to an `Empty` array will remove all accounts.&#92;n

functionPolicyTrustedAccounts

AWS > Lambda > Function > Policy > Trusted Access > Accounts

aws_lambda_function_policy_trusted_access_services

List of AWS Services that are trusted for access in the AWS Lambda function policy.&#92;n&#92;n```&#92;nexample:&#92;n  - sns.amazonaws.com&#92;n  - ec2.amazonaws.com&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all services.&#92;n

Policy	Setting	Note
AWS > Lambda > Function > Policy > Trusted Access	Check: Trusted Access
AWS > Lambda > Function > Policy > Trusted Access > Accounts	- "123456789012" - "987654321098"
AWS > Lambda > Function > Policy > Trusted Access > Services	- "sns.amazonaws.com" - "ec2.amazonaws.com"

Policy Settings