Back to Checks
aws

Lambda function resource-based policy does not allow public access

awslambda_function_not_publicly_accessible
Service: awslambdaSeverity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsLambdaFunction

AWS Lambda function resource-based policies are assessed for public access. The finding identifies policies with wildcard or empty Principal that allow actions like lambda:InvokeFunction to any principal.

Prowler logoProwlerprowler-provider-aws

Risk

Public invocation lets outsiders run code under the function's IAM role.

Impacts:

  • Confidentiality: data exfiltration via backend access
  • Integrity: unauthorized state changes from side effects
  • Availability/cost: invocation floods causing throttling and spend spikes

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks awslambda_function_not_publicly_accessible

Recommendation

Remove public principals from function policies. Grant access only to specific accounts, roles, or services using fixed ARNs and least privilege. Add conditions like AWS:SourceAccount and AWS:SourceArn to constrain service triggers. Enforce separation of duties and monitor access for defense in depth.

Remediation

CLI

aws lambda remove-permission --function-name <example_function_name> --statement-id <example_statement_id>

Terraform

# Restrict Lambda permission to a non-public principal
resource "aws_lambda_permission" "<example_resource_name>" {
  statement_id  = "AllowSpecificPrincipal"
  action        = "lambda:InvokeFunction"
  function_name = "<example_resource_name>"
  principal     = "123456789012"  # Critical: not "*"; prevents public access
}

NativeIaC

# CloudFormation: restrict Lambda permission to a non-public principal
Resources:
  <example_resource_name>Permission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: <example_resource_name>
      Principal: 123456789012  # Critical: not "*"; limits invoke permission to a specific account to prevent public access

Other

1Open the AWS Lambda console and select the function
2Go to Configuration > Permissions
3Under Resource-based policy, view the policy statements
4Find any statement with Principal set to "*" (or { "AWS": "*" })
5Delete that statement and save
6If access is needed, re-add a permission for a specific principal only (for example, an AWS account ID or a service principal)

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.awslambda.awslambda_client import awslambda_client
from prowler.providers.aws.services.iam.lib.policy import is_policy_public


class awslambda_function_not_publicly_accessible(Check):
    def execute(self):
        findings = []
        for function in awslambda_client.functions.values():
            if function.policy is None:
                continue
            report = Check_Report_AWS(metadata=self.metadata(), resource=function)

            report.status = "PASS"
            report.status_extended = f"Lambda function {function.name} has a resource-based policy without public access."
            if is_policy_public(
                function.policy,
                awslambda_client.audited_account,
                is_cross_account_allowed=True,
            ):
                report.status = "FAIL"
                report.status_extended = f"Lambda function {function.name} has a resource-based policy with public access."

            findings.append(report)

        return findings

References