AWS Lambda Function Policy Updated to Allow Public Invocation

Last updated 14 days ago on 2025-12-11

Created 2 years ago on 2024-04-30

About

Identifies when an AWS Lambda function policy is updated to allow public invocation. This rule detects use of the AddPermission API where the Principal is set to "*", enabling any AWS account to invoke the function. Adversaries may abuse this configuration to establish persistence, create a covert execution path, or operate a function as an unauthenticated backdoor. Public invocation is rarely required outside very specific workloads and should be considered high-risk when performed unexpectedly.

Tags

Domain: CloudData Source: AWSData Source: Amazon Web ServicesData Source: AWS LambdaUse Case: Threat DetectionTactic: PersistenceLanguage: eql

Severity

medium

Risk Score

MITRE ATT&CK™

Persistence (TA0003)(external, opens in a new tab or window)

↳ Event Triggered Execution (T1546)(external, opens in a new tab or window)

False Positive Examples

Some organizations may legitimately expose Lambda functions for cross-account or anonymous invocation (e.g., custom public APIs, integrations, or legacy architectures). Validate whether the function owner explicitly intended to make the function publicly invokable. Routine CI/CD deployments or IaC templates may also temporarily set permissive policies; confirm this is expected behavior before treating it as suspicious.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Event Correlation Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: filebeat-*logs-aws.cloudtrail-*
Related Integrations: aws(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗info where event.dataset == "aws.cloudtrail" 
    and event.provider == "lambda.amazonaws.com" 
    and event.outcome == "success" 
    and event.action : "AddPermission*" 
    and stringContains(aws.cloudtrail.request_parameters, "lambda:InvokeFunction") 
    and stringContains(aws.cloudtrail.request_parameters, "principal=\\*")

Install detection rules in Elastic Security

Detect AWS Lambda Function Policy Updated to Allow Public Invocation in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).