Policy Packs

guardrails-samples

Prevent unauthorized users from invoking functions, which can lead to security vulnerabilities and potential data breaches.

Enforce AWS Lambda Functions Restrict Public Access

main

aws_lambda_function_policy_trusted_access

Manage trusted access for AWS Lambda function.&#92;n&#92;nAWS allows Lambda functions to be shared with specific AWS accounts, services&#92;nand federated users. This policy allows you to configure&#92;nwhether such sharing is allowed, and to which principals.&#92;n&#92;nIf set to `Enforce: Revoke untrusted access`, access to non-trusted&#92;nmembers will be removed.&#92;n

functionPolicyTrustedAccess

AWS > Lambda > Function > Policy > Trusted Access

aws_lambda_function_policy_trusted_access_accounts

List of AWS Account IDs that are trusted for cross-account access in the&#92;nAWS Lambda function policy.&#92;n&#92;nNote that `Trusted Access &gt; Accounts` and `Trusted Access &gt;&#92;nOrganizations` are evaluated independently. To have access, an AWS&#92;nprincipal must be allowed in `Trusted Access &gt; Accounts` AND be a&#92;nmember of an Organization that is allowed in `Trusted Access &gt;&#92;nOrganizations`.&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;123456789012&quot;&#92;n```&#92;n**Note**: Setting the policy to an `Empty` array will remove all accounts.&#92;n

functionPolicyTrustedAccounts

AWS > Lambda > Function > Policy > Trusted Access > Accounts

aws_lambda_function_policy_trusted_access_services

List of AWS Services that are trusted for access in the AWS Lambda function policy.&#92;n&#92;n```&#92;nexample:&#92;n  - sns.amazonaws.com&#92;n  - ec2.amazonaws.com&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all services.&#92;n

Policy	Setting	Note
AWS > Lambda > Function > Policy > Trusted Access	Check: Trusted Access
AWS > Lambda > Function > Policy > Trusted Access > Accounts	- "123456789012" - "987654321098"
AWS > Lambda > Function > Policy > Trusted Access > Services	- "sns.amazonaws.com" - "ec2.amazonaws.com"

Policy Settings