Lambda Function Without Dead Letter Queue
- Query id: c2eae442-d3ba-4cb1-84ca-1db4f80eae3d
- Query name: Lambda Function Without Dead Letter Queue
- Platform: CloudFormation
- Severity: Low
- Category: Insecure Configurations
- URL: Github
Description¶
AWS Lambda Function should be configured for a Dead Letter Queue(DLQ)
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Postitive test num. 1 - yaml file
AWSTemplateFormatVersion: '2010-09-09'
Description: VPC function.
Resources:
Function:
Type: AWS::Lambda::Function
Properties:
Handler: index.handler
Role: arn:aws:iam::123456789012:role/lambda-role
Code:
S3Bucket: my-bucket
S3Key: function.zip
Runtime: nodejs12.x
Timeout: 5
TracingConfig:
Mode: Active
VpcConfig:
SecurityGroupIds:
- sg-085912345678492fb
SubnetIds:
- subnet-071f712345678e7c8
- subnet-07fd123456788a036
Tags:
- Key: Description
Value: VPC Function
- Key: Type
Value: AWS Lambda Function
Postitive test num. 2 - yaml file
AWSTemplateFormatVersion: '2010-09-09'
Description: VPC function.
Resources:
Function2:
Type: AWS::Lambda::Function
Properties:
Handler: index.handler
Role: arn:aws:iam::123456789012:role/lambda-role
Code:
S3Bucket: my-bucket
S3Key: function.zip
Runtime: nodejs12.x
Timeout: 5
TracingConfig:
Mode: Active
VpcConfig:
SecurityGroupIds:
- sg-085912345678492fb
SubnetIds:
- subnet-071f712345678e7c8
- subnet-07fd123456788a036
Tags:
- Key: Description
Value: VPC Function
- Key: Type
Value: AWS Lambda Function
DeadLetterConfig:
Code samples without security vulnerabilities¶
Negative test num. 1 - yaml file
AWSTemplateFormatVersion: '2010-09-09'
Description: VPC function.
Resources:
Function3:
Type: AWS::Lambda::Function
Properties:
Handler: index.handler
Role: arn:aws:iam::123456789012:role/lambda-role
Code:
S3Bucket: my-bucket
S3Key: function.zip
Runtime: nodejs12.x
Timeout: 5
TracingConfig:
Mode: Active
VpcConfig:
SecurityGroupIds:
- sg-085912345678492fb
SubnetIds:
- subnet-071f712345678e7c8
- subnet-07fd123456788a036
Tags:
- Key: Description
Value: VPC Function
- Key: Type
Value: AWS Lambda Function
DeadLetterConfig:
TargetArn: arn:aws:sqs:us-east-1:2324243535:aaa