AWS - Lambda Unauthenticated Access

Reading time: 2 minutes

tip

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

Check the subscription plans!
Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Public Function URL

It's possible to relate a Lambda with a public function URL that anyone can access. It could contain web vulnerabilities.

Public URL template

https://{random_id}.lambda-url.{region}.on.aws/

Get Account ID from public Lambda URL

Just like with S3 buckets, Data Exchange and API gateways, It's possible to find the account ID of an account abusing the aws:ResourceAccount Policy Condition Key from a public lambda URL. This is done by finding the account ID one character at a time abusing wildcards in the aws:ResourceAccount section of the policy.
This technique also allows to get values of tags if you know the tag key (there some default interesting ones).

You can find more information in the original research and the tool conditional-love to automate this exploitation.

tip