feat(Lambda): Service and checks (#1491)

providers/aws/services/awslambda/awslambda_function_not_publicly_accessible/awslambda_function_not_publicly_accessible.metadata.json

@@ -0,0 +1,35 @@
+{
+  "Provider": "aws",
+  "CheckID": "awslambda_function_not_publicly_accessible",
+  "CheckTitle": "heck if Lambda functions have resource-based policy set as Public.",
+  "CheckType": [],
+  "ServiceName": "lambda",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "arn:partition:lambda:region:account-id:function/function-name",
+  "Severity": "critical",
+  "ResourceType": "AwsLambdaFunction",
+  "Description": "Check if Lambda functions have resource-based policy set as Public.",
+  "Risk": "Publicly accessible services could expose sensitive data to bad actors.",
+  "RelatedUrl": "https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html",
+  "Remediation": {
+    "Code": {
+      "CLI": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/Lambda/function-exposed.html",
+      "NativeIaC": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/Lambda/function-exposed.html",
+      "Other": "",
+      "Terraform": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/Lambda/function-exposed.html"
+    },
+    "Recommendation": {
+      "Text": "Grant usage permission on a per-resource basis and applying least privilege principle.",
+      "Url": "https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"
+    }
+  },
+  "Categories": [],
+  "Tags": {
+    "Tag1Key": "value",
+    "Tag2Key": "value"
+  },
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "",
+  "Compliance": []
+}

providers/aws/services/awslambda/awslambda_function_not_publicly_accessible/awslambda_function_not_publicly_accessible.py

@@ -0,0 +1,42 @@
+from lib.check.models import Check, Check_Report
+from providers.aws.services.awslambda.awslambda_client import awslambda_client
+
+
+class awslambda_function_not_publicly_accessible(Check):
+    def execute(self):
+        findings = []
+        for function in awslambda_client.functions.values():
+            report = Check_Report(self.metadata)
+            report.region = function.region
+            report.resource_id = function.name
+            report.resource_arn = function.arn
+
+            report.status = "PASS"
+            report.status_extended = f"Lambda function {function.name} has a policy resource-based policy not public"
+
+            public_access = False
+            if function.policy:
+                for statement in function.policy["Statement"]:
+                    # Only check allow statements
+                    if statement["Effect"] == "Allow":
+                        if (
+                            "*" in statement["Principal"]
+                            or (
+                                "AWS" in statement["Principal"]
+                                and "*" in statement["Principal"]["AWS"]
+                            )
+                            or (
+                                "CanonicalUser" in statement["Principal"]
+                                and "*" in statement["Principal"]["CanonicalUser"]
+                            )
+                        ):
+                            public_access = True
+                            break
+
+            if public_access:
+                report.status = "FAIL"
+                report.status_extended = f"Lambda function {function.name} has a policy resource-based policy with public access"
+
+            findings.append(report)
+
+        return findings

providers/aws/services/awslambda/awslambda_function_not_publicly_accessible/awslambda_function_not_publicly_accessible_test.py

@@ -0,0 +1,189 @@
+from unittest import mock
+
+from moto.core import DEFAULT_ACCOUNT_ID
+
+from providers.aws.services.awslambda.awslambda_service import Function
+
+AWS_REGION = "us-east-1"
+
+
+class Test_awslambda_function_not_publicly_accessible:
+    def test_no_functions(self):
+        lambda_client = mock.MagicMock
+        lambda_client.functions = {}
+
+        with mock.patch(
+            "providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ):
+            # Test Check
+            from providers.aws.services.awslambda.awslambda_function_not_publicly_accessible.awslambda_function_not_publicly_accessible import (
+                awslambda_function_not_publicly_accessible,
+            )
+
+            check = awslambda_function_not_publicly_accessible()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_function_public(self):
+        lambda_client = mock.MagicMock
+        function_name = "test-lambda"
+        function_runtime = "nodejs4.3"
+        function_arn = (
+            f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}"
+        )
+        lambda_policy = {
+            "Version": "2012-10-17",
+            "Statement": [
+                {
+                    "Sid": "public-access",
+                    "Principal": {"AWS": ["*", DEFAULT_ACCOUNT_ID]},
+                    "Effect": "Allow",
+                    "Action": [
+                        "lambda:InvokeFunction",
+                    ],
+                    "Resource": [function_arn],
+                }
+            ],
+        }
+
+        lambda_client.functions = {
+            "function_name": Function(
+                name=function_name,
+                arn=function_arn,
+                region=AWS_REGION,
+                runtime=function_runtime,
+                policy=lambda_policy,
+            )
+        }
+
+        with mock.patch(
+            "providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ):
+            # Test Check
+            from providers.aws.services.awslambda.awslambda_function_not_publicly_accessible.awslambda_function_not_publicly_accessible import (
+                awslambda_function_not_publicly_accessible,
+            )
+
+            check = awslambda_function_not_publicly_accessible()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].region == AWS_REGION
+            assert result[0].resource_id == function_name
+            assert result[0].resource_arn == function_arn
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Lambda function {function_name} has a policy resource-based policy with public access"
+            )
+
+    def test_function_not_public(self):
+        lambda_client = mock.MagicMock
+        function_name = "test-lambda"
+        function_runtime = "nodejs4.3"
+        function_arn = (
+            f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}"
+        )
+        lambda_policy = {
+            "Version": "2012-10-17",
+            "Statement": [
+                {
+                    "Sid": "public-access",
+                    "Principal": {"AWS": [DEFAULT_ACCOUNT_ID]},
+                    "Effect": "Allow",
+                    "Action": [
+                        "lambda:InvokeFunction",
+                    ],
+                    "Resource": [function_arn],
+                }
+            ],
+        }
+
+        lambda_client.functions = {
+            "function_name": Function(
+                name=function_name,
+                arn=function_arn,
+                region=AWS_REGION,
+                runtime=function_runtime,
+                policy=lambda_policy,
+            )
+        }
+
+        with mock.patch(
+            "providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ):
+            # Test Check
+            from providers.aws.services.awslambda.awslambda_function_not_publicly_accessible.awslambda_function_not_publicly_accessible import (
+                awslambda_function_not_publicly_accessible,
+            )
+
+            check = awslambda_function_not_publicly_accessible()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].region == AWS_REGION
+            assert result[0].resource_id == function_name
+            assert result[0].resource_arn == function_arn
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Lambda function {function_name} has a policy resource-based policy not public"
+            )
+
+    def test_function_public_with_canonical(self):
+        lambda_client = mock.MagicMock
+        function_name = "test-lambda"
+        function_runtime = "nodejs4.3"
+        function_arn = (
+            f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}"
+        )
+        lambda_policy = {
+            "Version": "2012-10-17",
+            "Statement": [
+                {
+                    "Sid": "public-access",
+                    "Principal": {"CanonicalUser": ["*"]},
+                    "Effect": "Allow",
+                    "Action": [
+                        "lambda:InvokeFunction",
+                    ],
+                    "Resource": [function_arn],
+                }
+            ],
+        }
+
+        lambda_client.functions = {
+            "function_name": Function(
+                name=function_name,
+                arn=function_arn,
+                region=AWS_REGION,
+                runtime=function_runtime,
+                policy=lambda_policy,
+            )
+        }
+
+        with mock.patch(
+            "providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ):
+            # Test Check
+            from providers.aws.services.awslambda.awslambda_function_not_publicly_accessible.awslambda_function_not_publicly_accessible import (
+                awslambda_function_not_publicly_accessible,
+            )
+
+            check = awslambda_function_not_publicly_accessible()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].region == AWS_REGION
+            assert result[0].resource_id == function_name
+            assert result[0].resource_arn == function_arn
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Lambda function {function_name} has a policy resource-based policy with public access"
+            )