01 Create the trust relationship policy required for the execution role. This trust policy allows Amazon Lambda to use the role's permissions by giving the service principal "lambda.amazonaws.com" permission to call the AWS Security Token Service "AssumeRole" action. To create the required trust policy for the new IAM role, save the following policy document to a JSON file named cc-execution-role-trust-policy.json:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
02 Run create-role command (OSX/Linux/UNIX) to create a new IAM execution role using the trust relationship policy defined at the previous step:
aws iam create-role
--role-name cc-new-lambda-execution-role
--assume-role-policy-document file://cc-execution-role-trust-policy.json.json
03 The command output should return the metadata available for the new IAM role:
{
"Role": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
}
}
]
},
"RoleId": "AAAABBBBCCCCDDDDEEEEF",
"CreateDate": "2021-08-29T10:00:00Z ",
"RoleName": "cc-new-lambda-execution-role",
"Path": "/",
"Arn": "arn:aws:iam::123456789012:role/cc-new-lambda-execution-role"
}
}
04 The following AWS-managed policies provide permissions that are required to use Amazon Lambda features (see the official documentation for the updated list of managed policies):
- "AWSLambdaBasicExecutionRole" – permission to upload logs to Amazon CloudWatch Logs.
- "AWSLambdaDynamoDBExecutionRole" – permission to read records from an Amazon DynamoDB stream.
- "AWSLambdaKinesisExecutionRole" – permission to read events from an Amazon Kinesis data stream or consumer.
- "AWSLambdaMQExecutionRole" – permission to read records from an Amazon MQ broker.
- "AWSLambdaMSKExecutionRole" – permission to read records from an Amazon Managed Streaming for Apache Kafka (Amazon MSK) cluster.
- "AWSLambdaSQSQueueExecutionRole" – permission to read a message from an Amazon Simple Queue Service (Amazon SQS) queue.
- "AWSLambdaVPCAccessExecutionRole" – permission to manage elastic network interfaces to connect your function to a virtual private cloud (VPC).
- "AWSXRayDaemonWriteAccess" – permission to upload trace data to X-Ray.
- "CloudWatchLambdaInsightsExecutionRolePolicy" – permission to write runtime metrics to CloudWatch Lambda Insights.
05 Run attach-role-policy command (OSX/Linux/UNIX) to attach an AWS-managed policy to the newly created execution role. Based on your function's access requirements, choose the appropriate policy from the list of managed policies described at the previous step. In the following command request example, the "AWSLambdaSQSQueueExecutionRole" managed policy provides permission to read a message from an Amazon SQS queue (the command does not produce an output):
aws iam attach-role-policy
--role-name cc-new-lambda-execution-role
--policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaSQSQueueExecutionRole
06 Run update-function-configuration command (OSX/Linux/UNIX) using the name of the Amazon Lambda function that you want to reconfigure as the identifier parameter, to replace the shared execution role with the new IAM role created and configured at the previous steps:
aws lambda update-function-configuration
--region us-east-1
--function-name cc-sqs-poller
--role arn:aws:iam::123456789012:role/cc-new-lambda-execution-role
07 The command output should return the metadata available for the reconfigured function:
{
"LastUpdateStatus": "Successful",
"FunctionName": "cc-sqs-poller",
"LastModified": "2021-08-29T11:00:00.000+0000",
"RevisionId": "abcdabcd-1234-abcd-1234-abcd1234abcd",
"MemorySize": 128,
"State": "Active",
"Version": "$LATEST",
"Role": "arn:aws:iam::123456789012:role/cc-new-lambda-execution-role",
"Timeout": 45,
"Runtime": "nodejs12.x",
"TracingConfig": {
"Mode": "PassThrough"
},
"CodeSha256": "abcdabcdabcdabcdabcdabcdabcdabcdabcdabcd",
"Description": "",
"CodeSize": 403,
"FunctionArn": "arn:aws:lambda:us-east-1:123456789012:function:cc-sqs-poller",
"Handler": "index.handler"
}
08 Repeat steps no. 1 – 7 for each Amazon Lambda function that shares the execution role with other functions, available in the selected AWS region. Make sure that each Lambda function uses its own IAM execution role with the right set of permissions in order to promote the Principle of Least Privilege.
09 Change the AWS cloud region by updating the --region command parameter value and repeat steps no. 1 – 8 to perform the Remediation process for other regions.
Security