aws-lambda: Autogenerated Lambda roles contain the default policy
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 74
Description
### Describe the bug
Creating a Lambda function in CDK and then applying CDK Nag to it will throw the following error:
```
NIST.800.53.R5-IAMNoInlinePolicy: The IAM Group, User, or Role contains an inline policy - (Control IDs: AC-2i.2, AC-2(1), AC-2(6), AC-3, AC-3(3)(a), AC-3(3)(b)(1), AC-3(3)(b)(2), AC-3(3)(b)(3), AC-3(3)(b)(4), AC-3(3)(b)(5), AC-3(3)(c), AC-3(3), AC-3(4)(a), AC-3(4)(b), AC-3(4)(c), AC-3(4)(d), AC-3(4)(e), AC-3(4), AC-3(7), AC-3(8), AC-3(12)(a), AC-3(13), AC-3(15)(a), AC-3(15)(b), AC-4(28), AC-6, AC-6(3), AC-24, CM-5(1)(a), CM-6a, CM-9b, MP-2, SC-23(3)). AWS recommends to use managed policies instead of inline policies. The managed policies allow reusability, versioning and rolling back, and delegating permissions management
```
### Expected Behavior
CDK should remove the default policy by appending `.withoutPolicyUpdates()` to the end of all internal role instantiation.
### Current Behavior
CDK leaves the default policy present and this produces a CDK Nag violation.
### Reproduction Steps
Synthesize this stack and you will see (among other issues) the error above.
```
import * as cdk from 'aws-cdk-lib';
import * as cdk_nag from 'cdk-nag';
export class TestStack extends cdk.Stack {
constructor(scope: cdk.App, id: string) {
super(scope, id);
new cdk.aws_lambda.Function(this, 'myFunction', {
runtime: cdk.aws_lambda.Runtime.PYTHON_3_9,
code: cdk.aws_lambda.Code.fromAsset('./path/to/code'),
handler: 'myModule.myHandler',
});
cdk.Aspects.of(this).add(new cdk_nag.AwsSolutionsChecks({ verbose: true }));
cdk.Aspects.of(this).add(new cdk_nag.NIST80053R5Checks({ verbose: true }));
}
}
```
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CDK CLI Version
2.65.0
### Framework Version
_No response_
### Node.js Version
v18.12.1
### OS
na
### Language
Typescript
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Start at the aws_lambda.Function entry point and reproduce the synthesized stack with the CDK Nag checks shown in the issue. Trace the internal role instantiation and verify that the generated Lambda role no longer contains the default inline policy and that the reported CDK Nag violation is absent.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100