1. Sign in to the AWS Management Console.
2. Open the AWS Lambda console.
3. In the left navigation pane, choose “Functions”.
4. Select the Lambda function that you want to remediate.
5. Choose the “Permissions” tab.
6. Scroll down to the “Resource-based policy” section.
7. Click the “Edit” button.
8. In the “Policy” editor, remove any statements that allow cross-account access.
9. Click the “Save” button to save the updated policy.
10. Verify that the updated policy does not allow cross-account access.

​

1. Open the AWS CLI on your local machine or EC2 instance.
2. Run the following command to list all the Lambda functions in your AWS account:
   Copy

   Ask AI

   aws lambda list-functions
   

3. Identify the Lambda function that is allowing cross-account access.
4. Run the following command to update the Lambda function’s resource-based policy to deny cross-account access:
   Copy

   Ask AI

   aws lambda remove-permission --function-name <function-name> --statement-id <statement-id>
   

   Replace <function-name> with the name of the Lambda function that is allowing cross-account access, and <statement-id> with the ID of the statement that allows cross-account access. For example:
   Copy

   Ask AI

   aws lambda remove-permission --function-name my-function --statement-id AllowCrossAccountAccess
   

5. Verify that the resource-based policy has been updated by running the following command:
   Copy

   Ask AI

   aws lambda get-policy --function-name <function-name>
   

   Replace <function-name> with the name of the Lambda function that you updated. The output should show that the resource-based policy now denies cross-account access.
6. Repeat steps 4-5 for any other Lambda functions that are allowing cross-account access.
7. Once you have updated all the Lambda functions, verify that cross-account access is no longer allowed by attempting to access the Lambda function from a different AWS account.

1. Open the AWS Lambda console.
2. Click on the Lambda function that is allowing cross-account access.
3. Under the “Configuration” tab, click on “Permissions”.
4. Click on the “Remove” button next to the role that is allowing cross-account access.
5. Click on the “Add Permission” button.
6. Select the “AWS Service” radio button.
7. Choose the service that needs access to the Lambda function.
8. Choose the “Use a permission policy” option.
9. In the policy editor, add the following policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": {
        "AWS": "*"
      },
      "Action": "lambda:*",
      "Resource": "arn:aws:lambda:<region>:<account-id>:function:<function-name>",
      "Condition": {
        "ArnNotEquals": {
          "aws:SourceArn": "arn:aws:logs:<region>:<account-id>:log-group:/aws/lambda/<function-name>:*"
        }
      }
    }
  ]
}

10. Click on the “Add” button to save the new permission policy.