AWS Certified Security – SpecialtyDomain 1: Incident ResponseMedium
A security engineer is investigating a potential compromise involving an AWS Lambda function. The function's code was recently updated, and a GuardDuty finding indicates 'Stealth:Lambda/CodeModified.Unauthorized'. The engineer needs to rapidly roll back the Lambda function to a previous, known good version and prevent further unauthorized modifications. Which AWS Lambda feature should be utilized for this recovery?
- AUpdate the Lambda function's configuration to point to a previously published version or alias.
- BModify the IAM role associated with the Lambda function to remove 'lambda:UpdateFunctionCode' permissions.
- CPublish a new Lambda layer containing the original, trusted code and attach it to the function.
- DDelete the compromised Lambda function and recreate it from a trusted source code repository.
Show answer & explanationAnswer & explanation
Correct answer: A. Update the Lambda function's configuration to point to a previously published version or alias.
AWS Lambda automatically manages versions of your function code. By pointing the function's configuration (or an alias) to a previously published, known good version, you can instantly roll back the code. Preventing further unauthorized modifications would involve reviewing and tightening IAM permissions.
Why the other options are wrong
- B. While modifying IAM permissions is crucial for preventing *future* unauthorized modifications, it does not directly recover the compromised function code to a previous state.
- C. Lambda layers are for dependencies, not for deploying the primary function code itself. While you could put code in a layer, it's not the standard or most efficient way to roll back the main function code.
- D. Deleting and recreating a Lambda function is a destructive and time-consuming process that can lead to downtime and loss of configurations. Versioning provides a much faster and safer rollback.
Lambda Version Rollback
Utilizing AWS Lambda's versioning feature to quickly revert a function's code to a previous, known good state after a suspected compromise or unauthorized modification.
- Lambda automatically saves versions of code.
- Allows immediate rollback to any published version.
- Minimizes downtime during recovery.
Memory trick: Lambda versions are your quick-travel time machine for code.