Loading

AWS Lambda Layer Shared Externally

Identifies the modification of an AWS Lambda layer permission policy to grant another AWS account, an AWS Organization, or the public the ability to use a layer version. Lambda layers package code and dependencies that are loaded into the execution environment of any function that references them. Sharing a layer with an external account or with everyone can leak proprietary code or secrets bundled in the layer, and can serve as a supply-chain mechanism whereby downstream functions load attacker-influenced code. Layer sharing should be infrequent and deliberate, so newly granted external or public access warrants review.

Rule type: query
Rule indices:

  • logs-aws.cloudtrail-*

Rule Severity: medium
Risk Score: 47
Runs every: 5m
Searches indices from: now-6m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Cloud
  • Data Source: AWS
  • Data Source: Amazon Web Services
  • Data Source: AWS Lambda
  • Use Case: Threat Detection
  • Tactic: Execution
  • Tactic: Defense Evasion
  • Resources: Investigation Guide

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

AWS Lambda layers bundle code and dependencies that are loaded into the runtime of any function referencing them. AddLayerVersionPermission modifies a layer version's permission policy to allow another AWS account, an organization, or the public (principal=*) to use it. This can expose code or secrets contained in the layer and can act as a supply-chain vector for any function that consumes the layer.

This rule detects successful AddLayerVersionPermission calls. Public grants (principal=*) are the highest concern; specific cross-account grants should be validated against approved sharing.

  • Inspect aws.cloudtrail.request_parameters for the layerName, version number, action, and the granted principal (a specific account id, an organization id, or * for public).
  • Identify the actor in aws.cloudtrail.user_identity.arn and aws.cloudtrail.user_identity.type, and review source.ip and user_agent.original to understand how the grant was made.
  • Determine whether the layer contains sensitive code or secrets and whether external sharing was intended and approved.
  • Identify which functions reference the layer and whether the grant could influence their runtime.
  • Correlate with other activity by the same principal, such as layer publication (PublishLayerVersion) or function changes.
  • Shared utility layers distributed across an organization's accounts or to partners are a legitimate pattern. Confirm the grant is approved and exclude known distribution accounts or layers on aws.cloudtrail.user_identity.arn or the layer name after validation.
  • If the sharing is unauthorized, remove the layer permission (RemoveLayerVersionPermission) and rotate any secrets that may have been exposed in the layer.
  • Review which accounts accessed or copied the layer while the grant was in place and assess potential exposure.
  • Rotate or restrict credentials for the principal if compromise is suspected, and constrain lambda:AddLayerVersionPermission to a small set of trusted roles.
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "lambda.amazonaws.com"
    and event.action: AddLayerVersionPermission*
    and event.outcome: "success"

Framework: MITRE ATT&CK

Framework: MITRE ATT&CK