AWS lambda high security documentation change

Service: lambda · 2026-07-01 · Security-related high

File: lambda/latest/dg/services-iot.md

Summary

Added security warning and example for restricting AWS IoT invocation permissions

Security assessment

Explicitly warns about cross-account invocation risks and demonstrates proper permission restrictions using source-arn/source-account to prevent unauthorized access. This addresses a potential privilege escalation vulnerability.

Diff

diff --git a/lambda/latest/dg/services-iot.md b/lambda/latest/dg/services-iot.md
index 801d28008..5d5b3d393 100644
--- a//lambda/latest/dg/services-iot.md
+++ b//lambda/latest/dg/services-iot.md
@@ -29,0 +30,4 @@ You need to grant permission for the AWS IoT service to invoke your Lambda funct
+###### Important
+
+If you add a permission for an AWS IoT principal without providing the `source-arn` or `source-account`, any AWS account that creates a rule with your AWS Lambda action can activate rules to invoke your AWS Lambda function from AWS IoT. For more information, see [AWS Lambda permissions](https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html).
+    
@@ -32 +36,3 @@ You need to grant permission for the AWS IoT service to invoke your Lambda funct
-    --statement-id iot-events --action "lambda:InvokeFunction" --principal iot.amazonaws.com
+    --statement-id iot-events --action "lambda:InvokeFunction" --principal iot.amazonaws.com \
+    --source-arn arn:aws:iot:us-east-1:123456789012:rule/my-rule \
+    --source-account 123456789012
@@ -38 +44 @@ You should see the following output:
-        "Statement": "{\"Sid\":\"iot-events\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"iot.amazonaws.com\"},\"Action\":\"lambda:InvokeFunction\",\"Resource\":\"arn:aws:lambda:us-east-1:123456789012:function:my-function\"}"
+        "Statement": "{\"Sid\":\"iot-events\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"iot.amazonaws.com\"},\"Action\":\"lambda:InvokeFunction\",\"Resource\":\"arn:aws:lambda:us-east-1:123456789012:function:my-function\",\"Condition\":{\"ArnLike\":{\"AWS:SourceArn\":\"arn:aws:iot:us-east-1:123456789012:rule/my-rule\"},\"StringEquals\":{\"AWS:SourceAccount\":\"123456789012\"}}}"