# Ensure Lambda Public Access Prohibited

- Source: https://support.icompaas.com/support/solutions/articles/62000219522-ensure-lambda-public-access-prohibited
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## **Description:**

AWS Lambda is serverless compute service that runs your code in response to events and automatically manages the underlying compute resources for you. It is also used for extending other AWS services with custom logic or creating your back-end services that operate at AWS scale, performance, and security.

The code you run on AWS Lambda is called a **Lambda function.** These functions are stateless. After uploading your code to AWS Lambda, you can associate your function with a specific AWS resource.

  

## **Rationale:**

Identify any publicly accessible AWS Lambda functions and update their access policy to protect against unauthorized users that are sending requests to invoke these functions.

  

## **Impact:**

Unauthorized users or malicious users will not able to modify sources in the Lambda function over the internet. Unable to do any malicious activity after prohibited the public access of Lambda.

  

**Default value:**

By default, we added resources that we want to allow. 

  

### **Pre-Requisite:**

-   Sign in as an admin or IAM user with the required permissions
    
-   Decide principle, action, and conditions for the policy
    
-   Note down the policy statement configurations as backup
    

  

## **Remediation:**

  

## **Test Plan:**

1.  Log in to the AWS Management Console.
    
2.  Go to the Lambda dashboard at [https://console.aws.amazon.com/lambda/](https://console.aws.amazon.com/lambda/ "https://console.aws.amazon.com/lambda/").
    
3.  Click on the **Function,** in the navigation pane
    
4.  Choose the Lambda function that you want to examine and click on the function name
    
5.  Go to the **configuration** tab and click on **permissions**
    
6.  Scroll down to the **Resource-based policy** section and click on the policy statement that exists
    
7.  It will show up in the statement, make sure it should have principal and conditions defined  
    ![](https://support.icompaas.com/assets/kb/1ff9109dc679435d.png)  
    

If the **Principal** element has one of the following values: **"\*"** or **{ "AWS": "\*" }** and the function policy is not using any **Condition** then it means the function is public.

  

**Using AWS CLI:**

To know the permissions in the lambda function 

aws lambda get-policy \\
    --function-name <value>

### **Implementation Steps:**

1.  Log in to the AWS Management Console.
    
2.  Go to the Lambda dashboard at [https://console.aws.amazon.com/lambda/](https://console.aws.amazon.com/lambda/ "https://console.aws.amazon.com/lambda/").
    
3.  Click on the **Function,** in the navigation pane  
    ![](https://support.icompaas.com/assets/kb/81398eb846032df2.png)
    
4.  Choose the Lambda function that you want to modify and click on the function name
5.  Go to the **configuration** tab and click on **permissions**  
    **![](https://support.icompaas.com/assets/kb/be6863c815d3abc6.png)**
6.  **Scroll down to the Resource-based policy section and select the policy statement and click on Edit**  
    **![](https://support.icompaas.com/assets/kb/94a1a56c65b4952a.png)**
7.  **Specify the principal and source ARN in the policy statement, as you required, and click on save**

  

**Using AWS CLI:**

**To add the permission to lambda function**

aws lambda add-permission \\
    --function-name my-function \\
    --action lambda:InvokeFunction \\
    --statement-id sns \\
    --principal sns.amazonaws.com

  

## **Backout Plan**

To revoke the changes repeat the same implementation steps and specify the policy statement as you noted down.

  

## **Reference:**

1.  [![](https://support.icompaas.com/assets/kb/0a596745ad80f834.png)](https://docs.aws.amazon.com/config/latest/developerguide/lambda-function-public-access-prohibited.html)[lambda-function-public-access-prohibited - AWS Config](https://docs.aws.amazon.com/config/latest/developerguide/lambda-function-public-access-prohibited.html)
    
2.   [![](https://support.icompaas.com/assets/kb/e604e365f19a87a2.png)What is AWS Lambda? - AWS Lambda](https://docs.aws.amazon.com/lambda/latest/dg/welcome.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.