Lambda function Invoke API calls are recorded by CloudTrail

Check ID: awslambda_function_invoke_api_operations_cloudtrail_logging_enabled
Provider: AWS
Service: awslambda
Severity: LOW
Categories: logging
Resource type: AwsLambdaFunction

What this check verifies

AWS Lambda function invocations are recorded as CloudTrail data events when trails include AWS::Lambda::Function resources. The finding reflects whether a function’s Invoke activity is being logged by an eligible trail.

Risk

Without Lambda Invoke data events, per-invocation accountability is lost. Adversaries or misused automation can run code without an audit trail, obscuring actor, time, and source. This hinders forensics and enables covert exfiltration or unauthorized changes, impacting confidentiality and integrity.

Recommendation

Enable CloudTrail data event logging for AWS::Lambda::Function to capture Invoke calls across required Regions and accounts. Apply least privilege selectors to scope events, centralize logs with strong retention, and integrate alerts for anomalous invokes as part of defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cloudtrail put-event-selectors --trail-name <example_resource_name> --advanced-event-selectors '[{"FieldSelectors":[{"Field":"eventCategory","Equals":["Data"]},{"Field":"resources.type","Equals":["AWS::Lambda::Function"]}]}]'

resource "aws_cloudtrail" "<example_resource_name>" {
  name           = "<example_resource_name>"
  s3_bucket_name = "<example_resource_name>"

  event_selector {
    data_resource {
      type   = "AWS::Lambda::Function"  # Critical: enable Lambda data events
      values = ["arn:aws:lambda:<REGION>:<ACCOUNT_ID>:function"]  # Critical: capture Invoke for all functions in this account/region
    }
  }
}

Resources:
  <example_resource_name>:
    Type: AWS::CloudTrail::Trail
    Properties:
      S3BucketName: <example_resource_name>
      IsLogging: true
      EventSelectors:
        - DataResources:
            - Type: AWS::Lambda::Function  # Critical: enables Lambda data event logging
              Values:
                - arn:aws:lambda:<REGION>:<ACCOUNT_ID>:function  # Critical: logs Invoke events for all functions in the specified account/region

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = awslambda_function_invoke_api_operations_cloudtrail_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Lambda function is deployed inside a VPC Lambda function has a Dead Letter Queue configured

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires