Description

Detects AWS Lambda functions that have overly permissive resource-based policies which could allow unauthorized access. The detector identifies Lambda functions whose policy statements grant broad permissions to external principals, potentially exposing the function to security risks through unintended invocations.

Detection Strategy

• Scans all Lambda functions in the specified AWS region

• Retrieves and analyzes the resource-based policy (execution policy) attached to each Lambda function

• Reports a vulnerability when a policy statement contains overly permissive configurations such as wildcard principals ('*') or broad cross-account access

• Flags policy statements that grant excessive permissions beyond necessary function invocation rights