AWS managedservices medium security documentation change
Summary
Updated RFC change type for requesting additional Lambda permissions, adding '(review required)' to the process
Security assessment
The addition of a mandatory review step for granting additional Lambda permissions (e.g., VPC access) introduces a security control to prevent excessive privilege escalation. This addresses the risk of over-permissioned Lambda functions, which could be exploited in security incidents.
Diff
diff --git a/managedservices/latest/onboardingguide/lambda.md b/managedservices/latest/onboardingguide/lambda.md index 0c3307d81..055f73ef2 100644 --- a//managedservices/latest/onboardingguide/lambda.md +++ b//managedservices/latest/onboardingguide/lambda.md @@ -21 +21 @@ Request access by submitting a Management | AWS service | Self-provisioned servi - * By default AMS provides you with a basic Lambda initiation role containing the `AWSLambdaBasicExecutionRole` and `AWSXrayWriteOnlyAccess` permissions; for information, see [AWS Lambda Initiation Role](https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html). If you require additional permissions, such as the ability to provision Lambda functions within your AMS VPC, submit an RFC with the Management | Other | Other | Create (ct-1e1xtak34nx76). + * By default AMS provides you with a basic Lambda initiation role containing the `AWSLambdaBasicExecutionRole` and `AWSXrayWriteOnlyAccess` permissions; for information, see [AWS Lambda Initiation Role](https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html). If you require additional permissions, such as the ability to provision Lambda functions within your AMS VPC, submit an RFC with the Management | AWS service | Self-provisioned service | Add (review required)(ct-3qe6io8t6jtny) change type. @@ -28 +28 @@ Request access by submitting a Management | AWS service | Self-provisioned servi -There are no prerequisites or dependencies to get started with AWS Lambda; however, depending on your specific use case, you might require access to other AWS services to create event sources, or additional permissions for your function to perform various actions. If additional permissions are needed, submit an RFC with the Management | Other | Other | Create (ct-1e1xtak34nx76). +There are no prerequisites or dependencies to get started with AWS Lambda; however, depending on your specific use case, you might require access to other AWS services to create event sources, or additional permissions for your function to perform various actions. If additional permissions are needed, submit an RFC with the Management | AWS service | Self-provisioned service | Add (review required) change type (ct-3qe6io8t6jtny).