rage.fail

aws-lambda-executes-as

explicit aws emits ExecutesAs

match (record)

{ "field": "Configuration.Role", "resource_type": "AWS::Lambda::Function" }

emit

source type	`Compute`
source	`<function node>`
target	`<IAM role from Configuration.Role>`

Narrative

{function.name} executes as {role.name} (Lambda execution role).

Raw rule rules/explicit/aws-lambda.yaml

id: aws-lambda-executes-as
emits: ExecutesAs
applies_to:
- aws
match_record:
  resource_type: AWS::Lambda::Function
  field: Configuration.Role
emit:
  source_type: Compute
  source: <function node>
  target: <IAM role from Configuration.Role>
  api_source: lambda:GetFunctionConfiguration
  evidence_field: Configuration.Role
  narrative: '{function.name} executes as {role.name} (Lambda execution role).'