IAM group has excessive lambda:UpdateFunctionCode permissions

Description

lambda:UpdateFunctionCode permits changing Lambda function code. When code modified by a group member runs, it can operate with the function’s execution-role permissions.

Potential impact

This can misuse data access available to the execution role or alter the function’s normal behavior.

Remediation

Remove unnecessary code-update permission and limit required deployment permissions to approved functions. Minimize execution-role permissions and review code changes.

Examples

The examples remove Lambda code-update permission and leave the same group with EC2 describe permissions. This does not revert code already deployed.

Before

hcl

resource "aws_iam_group" "example" {
  name = "cosmic"
}

resource "aws_iam_group_policy" "example" {
  name  = "test_inline_policy"
  group = aws_iam_group.example.name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "lambda:UpdateFunctionCode",
        ]
        Effect   = "Allow"
        Resource = "*"
      },
    ]
  })
}

After

hcl

resource "aws_iam_group" "example" {
  name = "cosmic"
}

resource "aws_iam_group_policy" "example" {
  name = "inline_policy_run_instances"
  group = aws_iam_group.example.name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "ec2:Describe*",
        ]
        Effect   = "Allow"
        Resource = "*"
      },
    ]
  })
}