AWSOverview
Amazon Inspector provides continuous vulnerability assessment for eligible AWS Lambda functions and layers. Without Lambda standard scanning, dependency vulnerabilities reported by AWS are not surfaced for the function, which weakens vulnerability management for serverless workloads.
Enable Lambda scanning for accounts and Regions where Lambda is used, then investigate any findings by severity, exploitability, and exposure. Note that AWS currently excludes Lambda functions encrypted with customer-managed KMS keys from Lambda scanning; those functions need compensating dependency and code scanning in CI/CD.
Remediation guidance
Remediation
Enable Amazon Inspector Lambda standard scanning in the account and Region. Add Lambda code scanning when your organization wants provider-reported code findings in addition to dependency findings.
AWS CLI
Enable Lambda vulnerability scanning in the Region that owns the function:
aws inspector2 enable \
--region {{asset.region}} \
--resource-types AWS_LAMBDA_FUNCTION AWS_LAMBDA_CODE
Confirm account scan status:
aws inspector2 batch-get-account-status \
--region {{asset.region}}
Check Lambda coverage after Inspector has had time to scan eligible functions:
aws inspector2 list-coverage \
--region {{asset.region}} \
--filter-criteria 'resourceType=[{comparison=EQUALS,value=AWS_LAMBDA_FUNCTION}]'
Rollout guidance
- Enable Inspector from the security tooling or audit account where possible, and delegate administration through AWS Organizations.
- Triage findings by severity, exploitability, public exposure, and function criticality.
- Ensure eligible functions are invoked or updated periodically enough for Inspector coverage, and document intentionally excluded functions with expiry dates.
- For functions encrypted with customer-managed KMS keys, document the exception and enforce dependency/code scanning in CI/CD because AWS Inspector Lambda scanning does not currently cover them.
- Add the setting to account-baseline automation so new Regions do not drift.
References
- https://docs.aws.amazon.com/inspector/latest/user/scanning-lambda.html
- https://docs.aws.amazon.com/cli/latest/reference/inspector2/enable.html
Query logic
These are the stored checks tied to this control.
AWS Lambda functions without Amazon Inspector coverage
Connectors
Covered asset types
Expected check: eq []
{
functions(
where: {
cloudProvider: { eq: "aws" }
inspectorEnabled: { eq: false }
}
) {
...AssetFragment
}
}
