Lambda Security Notification ListTags -v- GetFunction

Question

We received an email saying that the Lambda get-function command will no longer list tags associated with the function unless the user calling it also has lambda:ListTags permission.

The only role under affected resources in the AWSServiceRoleforSupport - I'm guessing we can ignore this notification since we don't control this role?

Didier Durand · Answer

Hi,

What it means is that any form of code (CLI, SDK any language, etc.) that you execute from any place in your AWS account or on external machine (ved laptops, etc.) using Lambda getFunction() ( see https://docs.aws.amazon.com/lambda/latest/api/API_GetFunction.html) must have have the lambda:ListTags permission in corresponding IAM execution roles or principals if you want to continue getting the tags for this Lambda.

If you don't run such code, yes, you can forget the notification. If unsure, check all scripts, applications, etc that may use it and need tags.

Best,

Didier

Lambda Security Notification ListTags -v- GetFunction

Add your answer

Relevant content