Description

Avoid sharing IAM roles with multiple Lambda functions. As permissions are added to the role, these are shared across all functions using this role. By using one dedicated IAM role per function, you can control permissions more intentionally.

Impact

Execute actions that should be restricted to other groups or roles.

Recommendation

Every Lambda function should have a 1:1 relationship with an IAM role. Even if some functions have the same policy initially, always separate the IAM roles to ensure least privilege policies.

Threat

Authenticated attacker from the Internet with access to a misconfigured role.

Expected Remediation Time

⏱️ 30 minutes.

Requirements

Fixes