Question 1

Is authorization_type enforced for FFIEC Cybersecurity Assessment Tool?

Accepted Answer

Yes, This control verifies that the Lambda function does not have a publicly accessible URL. Exposing services publicly could potentially make sensitive data accessible to malicious actors.

Question 2

Is cloudwatch_logs_retention_in_days enforced for FFIEC Cybersecurity Assessment Tool?

Accepted Answer

Yes, Ensure a minimum duration of event log data is retained for your log groups to help with troubleshooting and forensics investigations.

Question 3

Is dead_letter_target_arn enforced for FFIEC Cybersecurity Assessment Tool?

Accepted Answer

Yes, Enable this rule to help notify the appropriate personnel through AWS Simple Queue Service (AWS SQS) or AWS Simple Notification Service (AWS SNS) when a function has failed.

Question 4

Is reserved_concurrent_executions enforced for FFIEC Cybersecurity Assessment Tool?

Accepted Answer

Yes, Checks whether the AWS Lambda function is configured with function-level concurrent execution limit. The control is non-compliant if the Lambda function is not configured with function-level concurrent execution limit.

Question 5

Is vpc_security_group_ids enforced for FFIEC Cybersecurity Assessment Tool?

Accepted Answer

Yes, Deploy AWS Lambda functions within an AWS Virtual Private Cloud (AWS VPC) for a secure communication between a function and other services within the AWS VPC.

Question 6

Is vpc_subnet_ids enforced for FFIEC Cybersecurity Assessment Tool?

Accepted Answer

Yes, Deploy AWS Lambda functions within an AWS Virtual Private Cloud (AWS VPC) for a secure communication between a function and other services within the AWS VPC.

AWS Lambda Terraform module

Terraform Module Source