aws / aws/aws-cdk

aws-lambda: Autogenerated Lambda roles contain the default policy

Open
#24,258 1 comment 4 reactions 0 assignees View on GitHub
@aws-cdk/aws-lambda effort/medium feature-request p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
1d 19h
Merged PRs (30d)
74

Description

### Describe the bug

Creating a Lambda function in CDK and then applying CDK Nag to it will throw the following error:

```
NIST.800.53.R5-IAMNoInlinePolicy: The IAM Group, User, or Role contains an inline policy - (Control IDs: AC-2i.2, AC-2(1), AC-2(6), AC-3, AC-3(3)(a), AC-3(3)(b)(1), AC-3(3)(b)(2), AC-3(3)(b)(3), AC-3(3)(b)(4), AC-3(3)(b)(5), AC-3(3)(c), AC-3(3), AC-3(4)(a), AC-3(4)(b), AC-3(4)(c), AC-3(4)(d), AC-3(4)(e), AC-3(4), AC-3(7), AC-3(8), AC-3(12)(a), AC-3(13), AC-3(15)(a), AC-3(15)(b), AC-4(28), AC-6, AC-6(3), AC-24, CM-5(1)(a), CM-6a, CM-9b, MP-2, SC-23(3)). AWS recommends to use managed policies instead of inline policies. The managed policies allow reusability, versioning and rolling back, and delegating permissions management
```

### Expected Behavior

CDK should remove the default policy by appending `.withoutPolicyUpdates()` to the end of all internal role instantiation.

### Current Behavior

CDK leaves the default policy present and this produces a CDK Nag violation.

### Reproduction Steps

Synthesize this stack and you will see (among other issues) the error above.

```
import * as cdk from 'aws-cdk-lib';
import * as cdk_nag from 'cdk-nag';

export class TestStack extends cdk.Stack {
constructor(scope: cdk.App, id: string) {
super(scope, id);

new cdk.aws_lambda.Function(this, 'myFunction', {
runtime: cdk.aws_lambda.Runtime.PYTHON_3_9,
code: cdk.aws_lambda.Code.fromAsset('./path/to/code'),
handler: 'myModule.myHandler',
});

cdk.Aspects.of(this).add(new cdk_nag.AwsSolutionsChecks({ verbose: true }));
cdk.Aspects.of(this).add(new cdk_nag.NIST80053R5Checks({ verbose: true }));
}
}
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.65.0

### Framework Version

_No response_

### Node.js Version

v18.12.1

### OS

na

### Language

Typescript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start at the aws_lambda.Function entry point and reproduce the synthesized stack with the CDK Nag checks shown in the issue. Trace the internal role instantiation and verify that the generated Lambda role no longer contains the default inline policy and that the reported CDK Nag violation is absent.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.