Ajinkya lambda prevention #129

ajinkya1986 · 2024-07-31T06:42:05Z

No description provided.

mpurusottamc · 2024-07-31T06:42:41Z

docs/aws/audit/lambdamonitoring/rules/admin_privilege.mdx

+    if 'Statement' in policy['PolicyDocument']:
+        for statement in policy['PolicyDocument']['Statement']:
+            if statement['Effect'] == 'Allow' and 'Action' in statement and '*' in statement['Action']:
+                print(f"Lambda function {function['FunctionName']} has administrative permissions.")


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T06:42:43Z

docs/aws/audit/lambdamonitoring/rules/admin_privilege_remediation.mdx

+```python
+session = boto3.Session(
+    aws_access_key_id='YOUR_ACCESS_KEY',
+    aws_secret_access_key='YOUR_SECRET_KEY',


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T06:42:45Z

docs/aws/audit/lambdamonitoring/rules/calls_in_cloudtrail.mdx

+
+4. **Enable CloudTrail if Not Enabled**:
+   If CloudTrail is not enabled, create a new trail and start logging.
+


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T06:42:47Z

docs/aws/audit/lambdamonitoring/rules/calls_in_cloudtrail.mdx

+        try:
+            trails = cloudtrail_client.describe_trails(trailNameList=[function['FunctionName']])
+            if not trails['trailList']:
+                print(f"CloudTrail is not enabled for the function: {function['FunctionName']}")


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T06:42:48Z

docs/aws/audit/lambdamonitoring/rules/calls_in_cloudtrail_remediation.mdx

+   # Initialize a session using Amazon EC2
+   session = boto3.Session(
+       aws_access_key_id='YOUR_ACCESS_KEY',
+       aws_secret_access_key='YOUR_SECRET_KEY',


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T06:42:50Z

docs/aws/audit/lambdamonitoring/rules/calls_in_cloudtrail_remediation.mdx

+try:
+    session = boto3.Session(
+        aws_access_key_id='YOUR_ACCESS_KEY',
+        aws_secret_access_key='YOUR_SECRET_KEY',


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T06:42:52Z

docs/aws/audit/lambdamonitoring/rules/check_cross_account_access.mdx

+        if statement['Principal'] == '*' or statement['Principal'] != 'YOUR_AWS_ACCOUNT_ID':
+            print(f"Lambda function {function['FunctionName']} allows cross-account access.")
+```
+


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T06:42:53Z

docs/aws/audit/lambdamonitoring/rules/check_cross_account_access_remediation.mdx

+```python
+session = boto3.Session(
+    aws_access_key_id='YOUR_ACCESS_KEY',
+    aws_secret_access_key='YOUR_SECRET_KEY',


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T06:42:55Z

docs/aws/audit/lambdamonitoring/rules/check_vpc_access.mdx

+
+This script will print the names of all Lambda functions that do not have access to VPC-only resources.
+</Accordion>
+


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T06:42:57Z

docs/aws/audit/lambdamonitoring/rules/check_vpc_access_remediation.mdx

+```python
+session = boto3.Session(
+    aws_access_key_id='YOUR_ACCESS_KEY',
+    aws_secret_access_key='YOUR_SECRET_KEY',


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T06:42:59Z

docs/aws/audit/lambdamonitoring/rules/default_timeout_used.mdx

+This script will print the names of all Lambda functions that do not have a default timeout set.
+</Accordion>
+
+</AccordionGroup>


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T06:43:00Z

docs/aws/audit/lambdamonitoring/rules/default_timeout_used_remediation.mdx

+
+   session = boto3.Session(
+       aws_access_key_id='your_access_key',
+       aws_secret_access_key='your_secret_access_key',


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T06:43:02Z

docs/aws/audit/lambdamonitoring/rules/dlq_configured.mdx

+            print(f"Lambda function {function_name} does not have DLQ configured.")
+```
+
+This script will print the names of all Lambda functions that do not have DLQ configured.


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T06:43:04Z

docs/aws/audit/lambdamonitoring/rules/dlq_configured_remediation.mdx

+
+session = boto3.Session(
+    aws_access_key_id='YOUR_ACCESS_KEY',
+    aws_secret_access_key='YOUR_SECRET_KEY',


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T06:43:05Z

docs/aws/audit/lambdamonitoring/rules/has_tags.mdx

+
+check_lambda_tags()
+```
+


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T06:43:07Z

docs/aws/audit/lambdamonitoring/rules/has_tags_remediation.mdx

+
+session = boto3.Session(
+    aws_access_key_id='YOUR_ACCESS_KEY',
+    aws_secret_access_key='YOUR_SECRET_KEY',


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T06:43:09Z

docs/aws/audit/lambdamonitoring/rules/lambda_concurrency.mdx

+       )
+       return response
+
+   # Example usage


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T06:43:10Z

docs/aws/audit/lambdamonitoring/rules/lambda_concurrency.mdx

+        FunctionName=function['FunctionName']
+    )
+    if 'ReservedConcurrentExecutions' not in function_details:
+        print(f"Lambda function {function['FunctionName']} does not have a concurrency limit set.")


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T06:43:12Z

docs/aws/audit/lambdamonitoring/rules/lambda_concurrency_remediation.mdx

+   import os
+
+   os.environ['AWS_ACCESS_KEY_ID'] = 'your_access_key_id'
+   os.environ['AWS_SECRET_ACCESS_KEY'] = 'your_secret_access_key'


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T06:43:14Z

docs/aws/audit/lambdamonitoring/rules/lambda_concurrency_remediation.mdx

+
+session = boto3.Session(
+    aws_access_key_id='YOUR_ACCESS_KEY',
+    aws_secret_access_key='YOUR_SECRET_KEY',


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T06:43:15Z

docs/aws/audit/lambdamonitoring/rules/lambda_step_functions_logging_enabled.mdx

+        print(f"Logging is not enabled for function: {function['FunctionName']}")
+```
+
+This script will print out the names of all the Lambda functions that do not have logging enabled. This is a misconfiguration as it's a best practice to enable logging for all Lambda functions to track and debug any issues.


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T06:43:17Z

docs/aws/audit/lambdamonitoring/rules/lambda_step_functions_logging_enabled_remediation.mdx

+
+session = boto3.Session(
+    aws_access_key_id='YOUR_ACCESS_KEY',
+    aws_secret_access_key='YOUR_SECRET_KEY',


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T06:43:19Z

docs/aws/audit/lambdamonitoring/rules/multiple_functions_with_same_iam.mdx

+    role = function['Role']
+    if role not in role_dict:
+        role_dict[role] = [function['FunctionName']]
+    else:


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T06:43:20Z

docs/aws/audit/lambdamonitoring/rules/multiple_functions_with_same_iam_remediation.mdx

+
+session = boto3.Session(
+    aws_access_key_id='YOUR_ACCESS_KEY',
+    aws_secret_access_key='YOUR_SECRET_KEY',


Secret: Secret Keyword

Click here for more details

ajinkyajawalkar added 2 commits May 16, 2024 16:58

Added cause for lambda

8718c46

Added lambda prevention

b869614

ajinkya1986 requested a review from mpurusottamc July 31, 2024 06:42

mpurusottamc reviewed Jul 31, 2024

View reviewed changes


		4. Enable CloudTrail if Not Enabled:
		If CloudTrail is not enabled, create a new trail and start logging.


		This script will print the names of all Lambda functions that do not have access to VPC-only resources.
		</Accordion>


		check_lambda_tags()
		```

Ajinkya lambda prevention #129

Are you sure you want to change the base?

Ajinkya lambda prevention #129

Uh oh!

Conversation

ajinkya1986 commented Jul 31, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants