Map Lambda function to the role it uses

Feature request template

Title: Map Lambda function to the role it uses

Description:

Describe your idea. Please be detailed. If a feature request, please describe the desired behavior, what scenario it enables, and how it would be used.

I don’t see lambda function as one of the services supported by this project. I think it would be really helpful to see what roles/permissions the lambda function has access to in cases the attacker can gain access to invoke a lambda

Also, even when the map was created, in the metadata of the role, is it possible that we can put in the IAM role policy to show in neo4j instead of just the name of the role. That way we dont have to go back and forth between the database and the actual account to check for permissions

Pseudo code would be something like this:

for each lambda:
    create_mapping("(lambda)-->(role)")

for each statement in eachh role:
    if lambda:Invoke in the policy:
        create_mapping("(role)-->(lambda)")

I can help and it looks like I will just need add a new file for lambda service under intel/aws right. How do I add the policy of the role/iam user to the metadata. I am not familiar with the query language of neo4j so I would have to learn that

Thank you for this great project

[eRaMvn]

@achantavy thank you! Your comment helped me a lot. I created a PR after testing on my account. Can you please review and provide any feedback? I am not too positive about the query to clean up

[achantavy]

Since we already have the (:AWSPrincipal:AWSRole)-->(:AWSPolicy)-->(:AWSStatement) path in the graph, I don’t think we should include statement information on the role/principal node because that’d be keeping redundant data in two different places and Neo4j isn’t the best at keeping lists on node fields (there are places where we keep lists on nodes but I don’t think it fits here). To get that statement permissions data, I’d recommend querying for that above path that I described.

I’m open to other opinions though!