Understanding misconfigurations

Finding misconfigurations in weak policies is one of the more important portions of pentesting AWS services such as Lambda and S3. Due to the security already being "built in" within the services, a lot of the issues presented in Lambda are due to misconfigurations on the user side of things. That does not mean that mistakes aren't made and that there couldn't be inherent flaws within Lambda; however, for sake of argument, we will be looking at its configurations.

A misconfiguration – for Lambda policy – occurs when a certain attribute is set in a "loose" manner. The word "loose" means that the policy allows more than was intended. These policies are what allow unauthorized individuals to view information that was not intended for their viewing, or worse, allow malicious vectors to view and exfiltrate that data.

Least privilege is another potential issue that we want to look out for, and we...