Lambda function resource-based policy blocks public access

Check ID: awslambda_function_not_publicly_accessible
Provider: AWS
Service: awslambda
Severity: CRITICAL
Categories: internet-exposed
Resource type: AwsLambdaFunction

What this check verifies

AWS Lambda function resource-based policies are assessed for public access. The finding identifies policies with wildcard or empty Principal that allow actions like lambda:InvokeFunction to any principal.

Risk

Public invocation lets outsiders run code under the function’s IAM role. Impacts:

Confidentiality: data exfiltration via backend access
Integrity: unauthorized state changes from side effects
Availability/cost: invocation floods causing throttling and spend spikes

Recommendation

Remove public principals from function policies. Grant access only to specific accounts, roles, or services using fixed ARNs and least privilege. Add conditions like AWS:SourceAccount and AWS:SourceArn to constrain service triggers. Enforce separation of duties and monitor access for defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws lambda remove-permission —function-name <example_function_name> —statement-id <example_statement_id>

# Restrict Lambda permission to a non-public principal
resource "aws_lambda_permission" "<example_resource_name>" {
  statement_id  = "AllowSpecificPrincipal"
  action        = "lambda:InvokeFunction"
  function_name = "<example_resource_name>"
  principal     = "123456789012"  # Critical: not "*"; prevents public access
}

# CloudFormation: restrict Lambda permission to a non-public principal
Resources:
  <example_resource_name>Permission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: <example_resource_name>
      Principal: 123456789012  # Critical: not "*"; limits invoke permission to a specific account to prevent public access

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = awslambda_function_not_publicly_accessible. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Lambda function environment variables do not contain secrets Lambda function URL CORS does not allow wildcard origins (*)

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires