> For the complete documentation index, see [llms.txt](https://docs.0xrushi.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.0xrushi.xyz/cloud-security/lambda-enumeration-cheat-sheet.md).

# Lambda Enumeration Cheat Sheet

## Lambda Enumeration Cheat Sheet

### 1. List All Lambda Functions

```bash
aws lambda list-functions --region [region]
```

**Output includes:**

* Function names
* Runtimes
* ARNs
* Last modified dates

***

### 2. Get Detailed Function Information

#### 2a. Full Function Configuration

```bash
aws lambda get-function-configuration --function-name [function-name]
```

**Returns:**

* IAM role
* Runtime
* Environment variables
* Timeouts
* Memory allocation

#### 2b. Code & Deployment Details

```bash
aws lambda get-function --function-name [function-name]
```

**Returns:**

* Pre-signed S3 URL to download function code
* Deployment package details

***

### 3. Check Invocation Access (Resource-Based Policy)

```bash
aws lambda get-policy --function-name [function-name]
```

**Look for:**

* `"Principal": "*"` (publicly accessible)
* Cross-account permissions
* Overly permissive policies

***

### 4. Identify Triggers & Event Sources

#### 4a. Async Event Sources

```bash
aws lambda list-event-source-mappings --function-name [function-name]
```

**Applies to:**

* SQS
* DynamoDB
* Kinesis
* Other stream/queue sources

#### 4b. Function URLs (Direct HTTP Endpoints)

```bash
aws lambda get-function-url-config --function-name [function-name]
```

**Risk indicator:**

* If `AuthType` is `NONE` → publicly invokable

***

### 5. Invoke the Function

#### Basic Invocation

```bash
aws lambda invoke --function-name [function-name] output.json
```

#### With Input Payload

```bash
aws lambda invoke --function-name [function-name] \
  --payload '{"key": "value"}' \
  output.json
```

***

### 6. Investigate Attached IAM Role

**Step 1:** Get role name from `get-function-configuration`

**Step 2:** Enumerate the role

```bash
aws iam get-role --role-name [role-name]
```

```bash
aws iam list-attached-role-policies --role-name [role-name]
```

```bash
aws iam list-role-policies --role-name [role-name]
```

**Red flags to look for:**

* `*` actions (overly permissive)
* `PassRole`
* `SecretsManager` access
* Database read/write permissions
* S3 access
* SNS/SQS publishing

***

### 7. Modify or Replace the Function

#### 7a. Update Function Code

```bash
aws lambda update-function-code --function-name [function-name] \
  --zip-file fileb://payload.zip
```

#### 7b. Update Configuration

```bash
aws lambda update-function-configuration --function-name [function-name] \
  --environment "Variables={VAR=value}"
```

**Use cases:**

* Persistence
* Data exfiltration
* Command injection (if role is over-permissioned)

***

### Quick Reference: Enumeration Flow

1. **Discover** → `list-functions`
2. **Inspect** → `get-function-configuration`
3. **Check Access** → `get-policy`
4. **Find Triggers** → `list-event-source-mappings`, `get-function-url-config`
5. **Test Invocation** → `invoke`
6. **Audit Permissions** → Check attached IAM role
7. **Escalate** → Modify if permissions allow


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.0xrushi.xyz/cloud-security/lambda-enumeration-cheat-sheet.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.