Skip to main content

🛡️ AWS Lambda Function auto-provisioning status🟢

Stats​

not available

Logic​

Description​

Open File

Description​

Identify AWS Lambda Functions that appear to be associated with AWS-managed automated provisioning or management workflows.

This policy checks for AWS-managed tag signals that can help identify a Lambda function as associated with AWS CloudFormation, AWS Service Catalog, or AWS Serverless Application Model (AWS SAM).

Rationale​

AWS-managed tags can provide evidence that a Lambda function was created by, attached to, or managed through an AWS service workflow. This allows to distinguish Lambda functions with supported AWS-managed provisioning indicators from Lambda functions that are not identified by this tag-based method.

Audit​

This policy classifies an AWS Lambda Function as identified by automated provisioning evidence when the function has one of the following supported tag signals:

  • One of the AWS CloudFormation stack-level tags:
    • aws:cloudformation:logical-id
    • aws:cloudformation:stack-id
    • aws:cloudformation:stack-name
  • One of the AWS Service Catalog AutoTags:
    • aws:servicecatalog:portfolioArn

... see more

Remediation​

Open File

Remediation​

Review the Lambda function and confirm whether it is associated with an expected automated provisioning or service-managed workflow.

Use the function tags, CloudFormation stack relationship, Service Catalog provisioned product, AWS SAM deployment source, and recent creation events to understand how the function was created or is managed.

Do not add or edit AWS-managed tags only to change this policy result. AWS-reserved tags and service-managed default tags are intended to be applied by the service that owns the provisioning workflow. Retire the function if review confirms it is no longer required.

policy.yaml​

Open File