Authenticate Requests from cloudformation stack to lambda

Question

I am creating a custom resource with lambda as service token. This lambda is present in a different account than custom resource. I want to authenticate requests in lambda and I want to ensure that only calls from cloudformation are allowed in the lambda. How can I do it?
I have already tried to use a resource policy in lambda like this to restrict calls but it doesn't work i.e. I am not able to call lambda as part of cloudformation deployment and custom resource creation.

```

{
  "ArnLike": {
    "AWS:SourceArn": "arn:aws:cloudformation:us-east-1::stack/*"
  }
}
```

Leo K · Answer

`aws:SourceArn`, `aws:SourceAccount`, and the other `aws:Source*` condition keys only apply to requests with an AWS service principal as the calling principal. The CloudFormation stack normally gets executed using an AWS IAM mechanism called Forward Access Sessions (FAS) in the security context of an IAM role in your account instead, or alternatively, using a custom IAM service role that's been passed to the CloudFormation service. In both cases, the `aws:Source*` keys won't be present in the request context of API calls the stack makes.

You could try using this condition test in your Lambda's resource-based policy to identify that the call is coming through CloudFormation. Note the "ForAnyValue:" prefix to the comparison operator, required when evaluating multivalued condition keys:
```json
"Condition": {
  "ForAnyValue:StringEquals": {
    "aws:CalledVia": "cloudformation.amazonaws.com"
  }
}
```

This might also work, requiring further that the last service in the FAS chain is CloudFormation. Only one service can be the last one, so this key is single-valued and must be evaluated with a comparison operator without the "ForAnyValue:" prefix. However, I'm not 100% sure that some other service might not be in between in the case of your custom resource, so it's possible this variation won't work:
```json
"Condition": {
  "StringEquals": {
    "aws:CalledViaLast": "cloudformation.amazonaws.com"
  }
}
```

Authenticate Requests from cloudformation stack to lambda

Add your answer

Relevant content