LAMBDA WEB FUNCTIONS: PUBLIC BY DEFAULT, AND ALREADY IN YOUR LAMBDA:* GRANTS

Summary from the TLDR InfoSec newsletter

Lambda Web Functions are a new AWS feature that allow for running a Node.js HTTP server behind a managed HTTPS domain. By default, the functions run with no authentication, and role credentials are included as environment variables, which could potentially be leaked for the full duration of the execution environment. Existing roles that grant lambda:* permissions have access to web functions by default, existing SCPs may not cover them, and visibility tooling may also miss functions, leading to the potential for shadow Web Functions being created and going unnoticed.