Check ID: awslambda_function_using_cross_account_layers
Provider: AWS
Service: awslambda
Severity: HIGH
Categories: software-supply-chain
Resource type: AwsLambdaFunction

What this check verifies

AWS Lambda functions use only layers published within the same AWS account, rather than layers owned by external accounts. A Lambda layer bundles shared code or dependencies that are injected into the function execution environment at runtime.

Risk

A layer from an external account is a supply chain dependency outside your control. If that account is compromised or the layer is updated maliciously, every consumer function executes attacker code with its IAM role — a direct privilege escalation and lateral movement path across all functions using that layer.

Recommendation

Eliminate cross-account layer dependencies by hosting all layers in your own AWS account.

Audit all layers with aws lambda get-function-configuration and inspect Layers[].Arn
Extract the account ID from the ARN (field 5 in colon-split) and compare against your account
For approved vendor layers, pin to a specific immutable version ARN and review on each update
Enforce this via SCP: deny lambda:UpdateFunctionConfiguration when lambda:Layer ARN does not match your account ID

Remediation

CLI
Terraform
Native IaC
Dashboard steps

Copy the cross-account layer version into your own account first:

aws lambda publish-layer-version —layer-name <layer-name> —zip-file fileb://<layer.zip>

Then update the function to use your own layer ARN:

aws lambda update-function-configuration —function-name <function-name> —layers <your-account-layer-arn>

resource "aws_lambda_layer_version" "example" {
  layer_name = "<layer-name>"
  filename   = "<layer.zip>"
}

resource "aws_lambda_function" "example" {
  function_name = "<example_resource_name>"
  role          = "<example_role_arn>"
  handler       = "index.handler"
  runtime       = "python3.12"
  filename      = "<example_package.zip>"

  layers = [aws_lambda_layer_version.example.arn]
}

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  OwnedLayer:
    Type: AWS::Lambda::LayerVersion
    Properties:
      LayerName: <layer-name>
      Content:
        S3Bucket: <bucket>
        S3Key: <key>
  LambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: <example_resource_name>
      Role: <example_role_arn>
      Handler: index.handler
      Runtime: python3.12
      Code:
        S3Bucket: <example_code_bucket>
        S3Key: <example_code_key>
      Layers:
        - !Ref OwnedLayer

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = awslambda_function_using_cross_account_layers. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Lambda function URL is not publicly accessible Lambda function uses a supported runtime

​What this check verifies

​Risk

​Recommendation

​Remediation

​Copy the cross-account layer version into your own account first:

​Then update the function to use your own layer ARN:

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

Copy the cross-account layer version into your own account first:

Then update the function to use your own layer ARN:

References

Where this check fires