Lambda function is publicly invocable

Severity: Medium
Service: Lambda
Check ID: LAMBDA_PUBLIC

What this check finds

Lambdas should not be publicly callable. Other resources such as an API Gateway should be used to call the Lambda.

Passing looks like: Lambda not internet accessible.

How to fix it

Remove the public resource-based policy from the Lambda function.

AWS CLI

aws lambda get-policy --function-name FUNCTION_NAME

Then remove the public statement:

aws lambda remove-permission --function-name FUNCTION_NAME --statement-id STATEMENT_ID

Use API Gateway or an ALB as the public endpoint instead.

Names in capitals are placeholders for your own resource. Review a command before you run it.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to Lambda function is publicly invocable
Framework	Controls
NIST SP 800-53 Rev5 (Moderate)	AC-3 Access Enforcement SC-7 Boundary Protection
NIST Cybersecurity Framework 2.0	PR.AA-05 Access permissions and authorizations are enforced with least privilege PR.IR-01 Networks and environments are protected from unauthorized logical access and usage
ISO/IEC 27001:2022 Annex A	A.5.15 Access control A.8.20 Networks security

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More Lambda checks

All Lambda checks