AWS security-lake medium security documentation change
Summary
Added documentation for managed policy update granting lambda:DeleteFunction permission
Security assessment
The policy change specifically enables cleanup of deprecated Lambda functions, reducing attack surface by removing outdated code. This directly addresses security hygiene by preventing retention of unused functions that could become vulnerabilities.
Diff
diff --git a/security-lake/latest/userguide/doc-history.md b/security-lake/latest/userguide/doc-history.md index 243362106..b0196fd05 100644 --- a//security-lake/latest/userguide/doc-history.md +++ b//security-lake/latest/userguide/doc-history.md @@ -12,0 +13 @@ Change| Description| Date +Updated managed policy| Security Lake has updated the managed policy `SecurityLakeResourceManagementServiceRolePolicy` to add `lambda:DeleteFunction` permission for deprecated SecurityLake_Glue_Partition_Updater_Lambda functions. This allows Security Lake to clean up deprecated Lambda functions as part of the migration to v2 sources and iceberg format. For information, see [Security Lake updates to AWS managed policies](https://docs.aws.amazon.com/security-lake/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-updates).| November 18, 2025