docs(cloud-security): the AWS front_doors preflight check - #328
Merged
Conversation
S1 adds a Lambda / API Gateway / load-balancer collector family and, with it, a `front_doors` credential check. Document what it means when it fails, and why it probes the per-function reads rather than a representative list call: a missing lambda:ListFunctionUrlConfigs grant fails silently — every function reads as having no URL, so a function anyone on the internet can invoke looks private. No new onboarding scope: SecurityAudit + ViewOnlyAccess already grant every call (verified against both managed policy documents and against a live role carrying only those two). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L7CkEf1fEa9Y8dBn5Utrx1
lcbill
previously approved these changes
Jul 30, 2026
maximelb
commented
Jul 30, 2026
maximelb
commented
Jul 30, 2026
Contributor
Author
|
Open findings (inline threads above):
|
…r-policy grants Two inaccuracies in the note, both caught in review: - The two managed policies grant the Lambda reads BETWEEN them, not each on its own: ViewOnlyAccess carries `lambda:List*` but not `lambda:GetPolicy`. - A denied ListFunctionUrlConfigs does not make functions read as private — the collector poisons its Lambda coverage instead. The check's value is catching a hand-rolled least-privilege policy at connect time rather than leaving the Lambda inventory unreadable on every sweep. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L7CkEf1fEa9Y8dBn5Utrx1
lcbill
approved these changes
Jul 30, 2026
maximelb
marked this pull request as ready for review
July 30, 2026 15:37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What was asked
S1 (AWS serverless/edge collectors — legion_cloudsec_host#119) adds a
front_doorscredentialcheck. Document it, per the rule that a per-provider onboarding scope change lands with the
collector that needs it.
What was done
Added the
front_doorsrow to the AWSprovider testcoverage table indocs/cloud-security/provider-setup/aws.md, plus a note on why it probes the per-function Lambdareads rather than a representative list call: a missing
lambda:ListFunctionUrlConfigsgrant failsSILENTLY — every function then reads as having no URL, so a function anyone on the internet can
invoke looks private.
No new onboarding scope is needed, so the setup instructions are unchanged. That was verified two
ways: against both managed policy documents (
SecurityAuditgrantslambda:List*,lambda:GetPolicy,apigateway:GET,elasticloadbalancing:Describe*;ViewOnlyAccessgrants theELBv2 describes and
apigateway:GET), and live — thefront_doorscheck passes against a rolecarrying only those two managed policies.
Testing
Docs-only. Markdown table + admonition, matching the surrounding style.
🤖 Generated with Claude Code
https://claude.ai/code/session_01L7CkEf1fEa9Y8dBn5Utrx1