新しいAWS Security Hubで危険な公開Lambda関数を検出し可視化してみた

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Lambda Exposure Findings Test - Security Hub検証用シンプルテンプレート'

Resources:
  # Lambda実行用IAMロール（意図的に過剰権限）
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: 'exposure-test-lambda-role'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      # 意図的な過剰権限（Misconfiguration Trait用）
      Policies:
        - PolicyName: OverPrivilegedPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - s3:*
                  - dynamodb:*
                  - rds:Describe*
                Resource: '*'
      Tags:
        - Key: Purpose
          Value: 'exposure-findings-test'
        - Key: Environment
          Value: 'test'

  # Exposure Findings対象のLambda関数
  ExposureLambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: 'exposure-test-function'
      Runtime: python3.8  # 意図的に古いランタイム（Misconfiguration）
      Handler: index.lambda_handler
      Role: !GetAtt LambdaExecutionRole.Arn
      Timeout: 30
      MemorySize: 128
      # 同時実行数制限（コスト制御）
      ReservedConcurrentExecutions: 3
      # VPC設定なし（デフォルトでVPC外配置 = Misconfiguration）
      Code:
        ZipFile: |
          import json
          import time
          import os

          def lambda_handler(event, context):
              """
              Exposure Findings テスト用Lambda関数
              """

              # レート制限（コスト制御）
              time.sleep(0.5)

              # 簡易認証チェック
              auth_token = event.get('queryStringParameters', {}).get('token') if event.get('queryStringParameters') else None

              if not auth_token or auth_token != "test-token-2025":
                  return {
                      'statusCode': 401,
                      'headers': {'Content-Type': 'application/json'},
                      'body': json.dumps({'error': 'Unauthorized access'})
                  }

              # 正常レスポンス
              response_data = {
                  'message': 'Hello from exposed Lambda function!',
                  'timestamp': int(time.time()),
                  'function_name': context.function_name,
                  'request_id': context.aws_request_id,
                  'status': 'success'
              }

              return {
                  'statusCode': 200,
                  'headers': {'Content-Type': 'application/json'},
                  'body': json.dumps(response_data, indent=2)
              }
      Environment:
        Variables:
          ENVIRONMENT: 'test'
          PURPOSE: 'exposure-findings-test'
      Tags:
        - Key: Purpose
          Value: 'exposure-findings-test'
        - Key: Environment
          Value: 'test'
        - Key: Security-Test
          Value: 'true'

  # Function URL実行許可（Reachability Traitの主要因）
  LambdaUrlInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref ExposureLambdaFunction
      Action: lambda:InvokeFunctionUrl
      Principal: '*'
      FunctionUrlAuthType: NONE

  # Function URL（認証なしパブリックアクセス）
  LambdaFunctionUrl:
    Type: AWS::Lambda::Url
    Properties:
      TargetFunctionArn: !GetAtt ExposureLambdaFunction.Arn
      AuthType: NONE  # 危険：認証なし
      Cors:
        AllowCredentials: false
        AllowHeaders:
          - 'Content-Type'
        AllowMethods:
          - GET
          - POST
        AllowOrigins:
          - '*'

  # CloudWatch Logs Group（短期保存）
  LambdaLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: '/aws/lambda/exposure-test-function'
      RetentionInDays: 3

Outputs:
  FunctionUrl:
    Description: 'Public Lambda Function URL'
    Value: !GetAtt LambdaFunctionUrl.FunctionUrl

  TestUrl:
    Description: 'Test URL with authentication token'
    Value: !Sub '${LambdaFunctionUrl.FunctionUrl}?token=test-token-2025'

  SecurityNotice:
    Description: 'SECURITY WARNING'
    Value: 'This Lambda function is intentionally insecure for testing purposes. DELETE after testing!'