question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Map Lambda function to the role it uses

See original GitHub issue

Feature request template

Title: Map Lambda function to the role it uses

Description:

Describe your idea. Please be detailed. If a feature request, please describe the desired behavior, what scenario it enables, and how it would be used.

I don’t see lambda function as one of the services supported by this project. I think it would be really helpful to see what roles/permissions the lambda function has access to in cases the attacker can gain access to invoke a lambda

Also, even when the map was created, in the metadata of the role, is it possible that we can put in the IAM role policy to show in neo4j instead of just the name of the role. That way we dont have to go back and forth between the database and the actual account to check for permissions

Pseudo code would be something like this:

for each lambda:
    create_mapping("(lambda)-->(role)")

for each statement in eachh role:
    if lambda:Invoke in the policy:
        create_mapping("(role)-->(lambda)")

I can help and it looks like I will just need add a new file for lambda service under intel/aws right. How do I add the policy of the role/iam user to the metadata. I am not familiar with the query language of neo4j so I would have to learn that

Thank you for this great project

Issue Analytics

  • State:closed
  • Created 3 years ago
  • Reactions:1
  • Comments:8 (7 by maintainers)

github_iconTop GitHub Comments

1reaction
eRaMvncommented, Jun 10, 2020

@achantavy thank you! Your comment helped me a lot. I created a PR after testing on my account. Can you please review and provide any feedback? I am not too positive about the query to clean up

1reaction
achantavycommented, Jun 5, 2020

Since we already have the (:AWSPrincipal:AWSRole)-->(:AWSPolicy)-->(:AWSStatement) path in the graph, I don’t think we should include statement information on the role/principal node because that’d be keeping redundant data in two different places and Neo4j isn’t the best at keeping lists on node fields (there are places where we keep lists on nodes but I don’t think it fits here). To get that statement permissions data, I’d recommend querying for that above path that I described.

I’m open to other opinions though!

Read more comments on GitHub >

github_iconTop Results From Across the Web

Python Map Lambda
The map() function runs a lambda function over the list [1, 2, 3, 4, 5] , building a ... Map is often used...
Read more >
Python Lambda Functions
Lambda functions can be used along with built-in functions like filter(), map() and reduce(). Using lambda() Function with filter(). The filter ...
Read more >
Lambda and Map() Functions in Python
This is a tutorial on lambda and map() functions in Python. Here, we will consider Python3. We start with the lambda function, and...
Read more >
An Explanation to Python's Lambda, Map, Filter and Reduce
Lambda functions are mainly used with the map functions as in-place functions. So, let's discuss the map functions.
Read more >
MAP Function in Google Sheets - a LAMBDA helper function
Learn how to use the MAP function in Google Sheets, an amazing function that transforms data into new arrays based on a custom...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found