AWS lambda medium security documentation change

Service: lambda · 2025-05-10 · Security-related medium

File: lambda/latest/dg/security-iam-awsmanpol.md

Summary

Removed references to the AWSLambdaExecute managed policy, including its entire documentation section.

Security assessment

The AWSLambdaExecute policy granted broad S3 and CloudWatch Logs permissions. Its removal from the documentation suggests AWS is deprecating this policy, likely due to security concerns about overprivileged access. Eliminating references to overly permissive policies reduces the risk of unintended resource exposure.

Diff

diff --git a/lambda/latest/dg/security-iam-awsmanpol.md b/lambda/latest/dg/security-iam-awsmanpol.md
index 521f12f0c..e8b3508c9 100644
--- a//lambda/latest/dg/security-iam-awsmanpol.md
+++ b//lambda/latest/dg/security-iam-awsmanpol.md
@@ -5 +5 @@
-AWSLambda_FullAccessAWSLambda_ReadOnlyAccessAWSLambdaBasicExecutionRoleAWSLambdaDynamoDBExecutionRoleAWSLambdaENIManagementAccessAWSLambdaExecuteAWSLambdaInvocation-DynamoDBAWSLambdaKinesisExecutionRoleAWSLambdaMSKExecutionRoleAWSLambdaRoleAWSLambdaSQSQueueExecutionRoleAWSLambdaVPCAccessExecutionRolePolicy updates
+AWSLambda_FullAccessAWSLambda_ReadOnlyAccessAWSLambdaBasicExecutionRoleAWSLambdaDynamoDBExecutionRoleAWSLambdaENIManagementAccessAWSLambdaInvocation-DynamoDBAWSLambdaKinesisExecutionRoleAWSLambdaMSKExecutionRoleAWSLambdaRoleAWSLambdaSQSQueueExecutionRoleAWSLambdaVPCAccessExecutionRolePolicy updates
@@ -29,2 +28,0 @@ For more information, see [AWS managed policies](https://docs.aws.amazon.com/IAM
-  * AWS managed policy: AWSLambdaExecute
-
@@ -141,8 +138,0 @@ For more information about this policy, including the JSON policy document and p
-
-## AWS managed policy: AWSLambdaExecute
-
-This policy grants `PUT` and `GET` access to Amazon Simple Storage Service and full access to CloudWatch Logs.
-
-You can attach the `AWSLambdaExecute` policy to your users, groups, and roles.
-
-For more information about this policy, including the JSON policy document and policy versions, see [AWSLambdaExecute](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSLambdaExecute.html) in the _AWS Managed Policy Reference Guide_.