Summary
Amazon Connect Salesforce Lambda deployments may expose a function that forwards caller-supplied parameters to privileged AWS service APIs without checking whether the caller is authorized to perform those operations. Any IAM principal granted permission to invoke the affected function could potentially use it to perform actions that the principal's own identity is explicitly denied.
Affected context
The issue occurs in deployments using the Amazon Connect Salesforce Lambda integration where the sfExecuteAWSService function remains available and can invoke privileged AWS APIs on behalf of callers. Risk depends on the function's IAM execution role, its invocation policy, the services it can access, and whether caller-supplied parameters are accepted without authorization checks.
Exploit preconditions
- Attack surface: An AWS Lambda function exposed through an invocation path
- Required access: An IAM principal with
lambda:InvokeFunctionpermission on the affected function - Trigger point: Invocation of
sfExecuteAWSServicewith parameters selecting an AWS service operation - Why exploitation is possible: The function may execute operations using its more-privileged role without validating whether the invoking principal is authorized to request those operations
Why this happens
The underlying flaw is an authorization design failure: a privileged Lambda function acts as a proxy to AWS service APIs but does not enforce authorization based on the caller's identity and requested operation. This maps to CWE-862: Missing Authorization, where access-control checks are absent or insufficient before a protected action is performed. The insecure pattern separates invocation permission from downstream operation authorization and implicitly trusts caller-supplied service parameters.
Potential impact
- An attacker may perform AWS API operations denied to their own IAM identity.
- The function could enable unauthorized access to cloud resources or data.
- An attacker could modify, delete, or create AWS resources permitted to the Lambda execution role.
- The affected account or connected application environment could experience privilege escalation and operational disruption.
General mitigation guidance
Mitigation should focus on ensuring that callable functions cannot act as unrestricted privilege-broker services.
Common defensive patterns include:
- Remove or disable unused privileged execution functions.
- Restrict invocation policies to only the intended identities and trusted service paths.
- Enforce explicit authorization for each downstream AWS operation using the caller's identity and permitted scope.
- Replace caller-selected service dispatch with narrowly defined functions for specific business actions.
- Apply least-privilege permissions to the Lambda execution role and limit access to only required resources.
- Validate and constrain all caller-supplied operation and resource parameters.
- Monitor and review cross-service Lambda activity for unexpected callers or operations.
How teams detect issues like this
Organizations can identify similar risks through:
- Static analysis and code review searches for Lambda handlers that dispatch request parameters to multiple AWS APIs.
- Review of functions whose execution roles have broader permissions than their callers.
- Checks for missing caller-identity authorization before privileged downstream operations.
- IAM policy analysis for broad
lambda:InvokeFunctiongrants and excessive Lambda execution-role permissions. - CloudTrail and Lambda monitoring for unexpected invokers, API operations, resources, or invocation patterns.
- Policy-as-code controls that require explicit authorization boundaries around privileged function endpoints.
