Why isn't ARNLike condition enough to suppress "Lambda function policies should prohibit public access" warning?

0

Hello,

I have a lambda function with policies with the following format:

      "Effect": "Allow",
      "Principal": {
        "Service": "s3.amazonaws.com"
      },
      "Action": "lambda:InvokeFunction",
      "Resource": "arn:aws:lambda:<lambda-arn>",
      "Condition": {
        "ArnLike": {
          "AWS:SourceArn": "arn:aws:s3:::<s3-arn>"
        }

In the security hub I have the following critical warning for the same lambda function:

Lambda.1 Lambda function policies should prohibit public access

From my understanding, this finding wishes me to add a "AWS:SourceAccount" account condition as well. However my opinion is that considering I own the s3 bucket, only my bucket can invoke this lambda function. This is as secure as adding the source account condition, if I always keep owning this bucket.

My question is from a security standpoint am I safe to suppress this warning and move on, or is there something I am missing?

Thank you.

1개 답변
0
수락된 답변

Yes, I think that unintended access is unlikely to occur if you always have the S3 that you specify in "AWS:SourceArn" as you recognize.
However, if an S3 is deleted by mistake, an unrelated third party will be able to create the same S3 as the one specified in "AWS:SourceArn".
I think it is useful to set up "AWS:SourceAccount" in case such a situation arises.

profile picture
전문가
답변함 일 년 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠