Skip to main content
selectdraftAWS
Serviceslambda
CredentialsAWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
Permissionslambda:GetPolicy
Fan-out: account - one call per account. One call per function when swept across a region

Lambda functions with public resource policies

Reads the resource policy attached to a Lambda function and flags whether any statement grants invoke rights to a wildcard principal. A wildcard principal without a narrowing condition means anyone can invoke the function. Policies are per-function, so enumerate with aws/lambda/functions-list and iterate this query over the results.

Query​

SELECT
'{{function_name}}' as function_name,
CASE WHEN instr(policy, '"Principal":"*"') > 0 OR instr(policy, '"AWS":"*"') > 0 THEN 'true' ELSE 'false' END as allows_wildcard_principal,
CASE WHEN instr(policy, 'AWS:SourceArn') > 0 THEN 'true' ELSE 'false' END as has_source_arn_condition,
CASE WHEN instr(policy, 'AWS:SourceAccount') > 0 THEN 'true' ELSE 'false' END as has_source_account_condition,
policy
FROM aws.lambda.policies
WHERE region = '{{region}}'
AND function_name = '{{function_name}}';

A function URL with auth_type NONE is publicly invokable over HTTPS regardless of the resource policy, and is the other way a Lambda ends up exposed:

SELECT function_url, auth_type, function_arn
FROM aws.lambda.function_url_configs
WHERE region = '{{region}}'
AND function_name = '{{function_name}}';

Notes​

An empty result means the function has no resource policy at all, which is the safe state - the API raises ResourceNotFoundException and stackql surfaces it as zero rows, not an error. A wildcard principal is not automatically a finding: AWS service integrations legitimately add statements with a service principal or with Principal * narrowed by an AWS:SourceArn or AWS:SourceAccount condition, which is why those conditions are flagged separately. Treat a wildcard principal with neither condition as the real exposure, and always read the returned policy document before reporting. The policy is a JSON string whose Statement key may hold an object or an array depending on statement count, so string matching is more robust here than positional JSON extraction. The function_name column is projected from the parameter because the policy resource returns only the policy document and its revision id.

Related queries