Lambda function policies should prohibit public access
Verifies that Lambda function resource-based policies do not grant public access from outside the account.
- service
- Lambda
- severity
- Critical
- scope
- evaluated in every region
How to fix it
Have the named function's resource-based policy grant invoke rights only to principals you name, never to the wildcard. Statements are removed one at a time by statement identifier, which the finding does not carry, so read the current policy first. A function URL with an auth type of NONE is what makes a function anonymously invokable, and is the usual cause here: switch that URL to AWS_IAM, because removing the open statement AWS wrote for it leaves the URL refusing every call. A condition clears the finding only when it bounds the grant to a principal you control.
In the console
Lambda → Functions → the function → Configuration → Permissions → Resource-based policy statements
With the AWS CLI
aws lambda remove-permission --function-name <function-name> --statement-id <statement-id> --region <region>See which of your accounts this check is failing on.
Book a demo