​
Event Information

  • The CreateFunction20150331 event in AWS for Lambda refers to the creation of a new Lambda function in the AWS environment.
  • This event indicates that a user or an automated process has successfully created a new Lambda function using the AWS Lambda service.
  • The event provides information about the function’s configuration, such as its name, runtime, handler, and other settings that were specified during the creation process.

​
Examples

  • Unauthorized access: If the CreateFunction20150331 API in AWS Lambda is not properly secured, it could potentially allow unauthorized users to create or modify Lambda functions. This could lead to malicious actors gaining access to sensitive data or executing unauthorized code within the environment.

  • Data exposure: Inadequate security measures in the CreateFunction20150331 API could result in the exposure of sensitive data stored within Lambda functions. This could include personally identifiable information (PII), financial data, or any other confidential information that is processed by the functions.

  • Code injection: If the CreateFunction20150331 API is not properly secured, it could be vulnerable to code injection attacks. This could allow attackers to inject malicious code into Lambda functions, potentially leading to the execution of unauthorized actions or the compromise of the underlying infrastructure.

​
Remediation

​
Using Console

  1. Identify the specific issue or vulnerability in the AWS Lambda function by reviewing the event logs or security findings in the AWS console.

  2. Determine the appropriate remediation action based on the nature of the issue. For example:

    • If the issue is related to excessive permissions, review the function’s IAM role and remove any unnecessary or overly permissive policies.
    • If the issue is related to outdated or vulnerable dependencies, update the function’s code to use the latest versions of the dependencies or libraries.
    • If the issue is related to insecure environment variables, review the function’s configuration and ensure that sensitive information is not exposed.

  3. Implement the remediation action by following these steps in the AWS console:

    • Go to the AWS Lambda service in the AWS Management Console.
    • Select the specific Lambda function that needs remediation.
    • Depending on the issue, navigate to the relevant section in the console. For example, if the issue is related to IAM permissions, go to the “Permissions” tab.
    • Make the necessary changes to address the issue. This may involve modifying IAM policies, updating code, or adjusting configuration settings.
    • Save the changes and test the function to ensure it is functioning as expected.

Note: The specific steps may vary depending on the nature of the issue and the AWS console interface. It is important to carefully review the documentation and guidance provided by AWS for the specific remediation action.

​
Using CLI

  1. Enable VPC configuration for AWS Lambda:

    • Use the update-function-configuration command to update the Lambda function’s configuration.
    • Specify the --vpc-config parameter with the appropriate VPC configuration details, such as SubnetIds and SecurityGroupIds.
    • Example command: aws lambda update-function-configuration --function-name <function-name> --vpc-config SubnetIds=<subnet-ids>,SecurityGroupIds=<security-group-ids>

  2. Enable encryption at rest for AWS Lambda function code:

    • Use the update-function-configuration command to update the Lambda function’s configuration.
    • Specify the --kms-key-arn parameter with the ARN of the KMS key to be used for encryption.
    • Example command: aws lambda update-function-configuration --function-name <function-name> --kms-key-arn <kms-key-arn>

  3. Enable AWS CloudTrail logging for AWS Lambda:

    • Use the update-function-configuration command to update the Lambda function’s configuration.
    • Specify the --tracing-config parameter with the appropriate tracing configuration details, such as Mode set to Active.
    • Example command: aws lambda update-function-configuration --function-name <function-name> --tracing-config Mode=Active

​
Using Python

  1. Example 1: Increase Lambda function timeout
    • Identify the Lambda function that requires a timeout increase.
    • Use the AWS SDK for Python (Boto3) to update the function’s configuration.
    • Set the timeout parameter to a higher value, such as 5 minutes (300 seconds).
    • Here’s an example Python script to achieve this:
import boto3

lambda_client = boto3.client('lambda')

def increase_timeout(lambda_function_name):
    response = lambda_client.update_function_configuration(
        FunctionName=lambda_function_name,
        Timeout=300
    )
    print(f"Timeout increased for Lambda function {lambda_function_name}")

increase_timeout('my-lambda-function')
  1. Example 2: Enable VPC configuration for Lambda function
    • Identify the Lambda function that needs to be associated with a VPC.
    • Use the AWS SDK for Python (Boto3) to update the function’s configuration.
    • Set the VpcConfig parameter with the appropriate VPC configuration details.
    • Here’s an example Python script to achieve this:
import boto3

lambda_client = boto3.client('lambda')

def enable_vpc(lambda_function_name, vpc_id, subnet_ids):
    response = lambda_client.update_function_configuration(
        FunctionName=lambda_function_name,
        VpcConfig={
            'SubnetIds': subnet_ids,
            'SecurityGroupIds': [],
            'VpcId': vpc_id
        }
    )
    print(f"VPC configuration enabled for Lambda function {lambda_function_name}")

enable_vpc('my-lambda-function', 'vpc-12345678', ['subnet-12345678', 'subnet-87654321'])
  1. Example 3: Enable encryption at rest for Lambda function
    • Identify the Lambda function that needs encryption at rest.
    • Use the AWS SDK for Python (Boto3) to update the function’s configuration.
    • Set the KMSKeyArn parameter with the ARN of the KMS key to be used for encryption.
    • Here’s an example Python script to achieve this:
import boto3

lambda_client = boto3.client('lambda')

def enable_encryption(lambda_function_name, kms_key_arn):
    response = lambda_client.update_function_configuration(
        FunctionName=lambda_function_name,
        KMSKeyArn=kms_key_arn
    )
    print(f"Encryption at rest enabled for Lambda function {lambda_function_name}")

enable_encryption('my-lambda-function', 'arn:aws:kms:us-east-1:123456789012:key/abcd1234-5678-90ef-ghij-klmnopqrstuv')