Control: 5 VPC Lambda functions should operate in multiple Availability Zones

Description

This control checks if Lambda has more than one availability zone associated. The rule fails if only one availability zone is associated with Lambda.

Deploying resources across multiple Availability Zones is an AWS best practice to ensure high availability within your architecture. Availability is a core pillar in the confidentiality, integrity, and availability triad security model. All Lambda functions should have a multi-Availability Zone deployment to ensure that a single zone of failure does not cause a total disruption of operations.

Remediation

To deploy a Lambda function in multiple Availability Zones through console:

Open the AWS Lambda console
From the Functions page on the Lambda console choose a function.
Choose Configuration and then choose VPC.
Choose Edit.
If the function was not originally connected to a VPC, select a VPC from the dropdown menu. If the function was not originally connected to a VPC, choose at least one security group to attach to the function.
Choose Save.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.foundational_security_lambda_5

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.foundational_security_lambda_5 --share

SQL

This control uses a named query:

select
  arn as resource,
  case
    when vpc_id is null or vpc_id = '' then 'skip'
    else case
      when
      (
        select
          count(distinct availability_zone_id)
        from
          aws_vpc_subnet
        where
          subnet_id in (select jsonb_array_elements_text(vpc_subnet_ids) )
      ) >= 2
      then 'ok'
      else 'alarm'
    end
  end as status,
  case
    when vpc_id is null or vpc_id = '' then title || ' is not in VPC.'
    else title || ' has ' || jsonb_array_length(vpc_subnet_ids) || ' availability zone(s).'
  end as reason
  
  , region, account_id
from
  aws_lambda_function;

Control: 5 VPC Lambda functions should operate in multiple Availability Zones

Description

Remediation

Usage

SQL

Tags