Amazon Lambda

Amazon Web Services

Overview

Integrates with AWS Lambda to inventory the Lambda functions across the configured AWS accounts and regions. For each function the connector reads its configuration (runtime, packaging, VPC placement, layers, encryption key, environment variable keys) and its exposure surface — the Function URL configuration and the resource-based invocation policy — so downstream analysis can flag publicly reachable functions. The connector enumerates functions region by region via the Lambda ListFunctions API and emits one Brinqa object per function.

Data retrieved from Amazon Lambda

Connector Object	Required	Maps to Data Model
LambdaFunction	Yes	Serverless

note

For detailed steps on how to view the data retrieved from Amazon Lambda in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select Amazon Lambda from the Connector dropdown and provide the following:

Setting	Required	Default	Description
Access key ID	No	—	AWS user access key ID, if not specified, the connector consults the default credentials provider chain to try and determine the \
Secret access key	No	—	AWS user secret access key, if not specified, the connector consults the default credentials provider chain to try and determine the \
Default region	No	us-east-1	Default AWS region, if not specified, the connector consults the default region provider chain to try and determine the region to use.
Assume role	No	— (empty)	Amazon Resource Name for the role to assume.
Session duration	No	900	Assume role session duration in seconds.
Page size	No	100	The maximum number of results to retrieve per operation.

Authentication

Authentication is shared across the AWS connector bundle via the AwsConfiguration base class. The Lambda sub-connector uses the AWS SDK for Java v2 LambdaClient, which signs every request with AWS SigV4 using credentials resolved through the following chain (in order):

1. STS AssumeRole — if assumeRoleARN is configured, the connector assumes that role (using the credentials below as the principal) and uses the resulting temporary session credentials.
2. Static access keys — if accessKey / secretKey are configured, they are used directly.
3. Default credentials provider chain — environment variables, ~/.aws/credentials, container role, or EC2 instance metadata.

Assumed-role sessions use the configurable sessionDuration (default 900 s) with a unique session name per sync. assumeRoleARN may be a comma-separated list to sync multiple accounts in one run. A LambdaClient is constructed per role per region; each client is closed once its region has been fully synced.

Required AWS API permissions

Permission	Purpose
ec2:DescribeRegions	Enumerate the regions to sync when no explicit region/regions option is supplied
lambda:ListFunctions	List and page through functions in each region
lambda:GetFunctionUrlConfig	Read the Function URL and its auth type (public-URL detection)
lambda:GetPolicy	Read the resource-based policy (public-invocation detection)
lambda:ListTags	Read function tags
sts:AssumeRole	Only when assumeRoleARN is set

How to obtain Amazon Lambda credentials

Create an IAM user for AWS access

For the Amazon Lambda connector to interact with the AWS SDK and retrieve Lambda function data, you must provide specific AWS credentials and permissions. To create an IAM user, follow these steps:

1. Log in to your organization's AWS Management Console as an administrator.

2. Navigate to the Identity and Access Management (IAM) dashboard.

3. From the navigation pane under Access management, click Users, and then click Create user.

4. Provide a User name, leave the Provide user access to AWS Management Console option unchecked, and then click Next.

5. Click the Attach policies directly option and then click Create policy.

6. Click the JSON tab and paste the following minimum required policy:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "lambda:ListFunctions",
           "lambda:GetFunctionUrlConfig",
           "lambda:GetPolicy",
           "lambda:ListTags"
         ],
         "Resource": "*"
       }
     ]
   }

7. Click Next, provide a name for the policy, and then click Create policy.

8. Back on the Add permissions page, search for and select the policy you just created, and then click Next.

9. Click Create user.

Note: If you do not have permissions to create a new IAM user, contact your AWS administrator. For additional information, see AWS documentation.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

LambdaFunction

Source Field Name	SDM Attribute
constant AWS	CLOUD_PROVIDER
derived — see below	IS_URL_PUBLIC
derived — see below	IS_PUBLICLY_INVOCABLE
FunctionConfiguration.architecturesAsStrings()	ARCHITECTURES (multivalued)
FunctionConfiguration.codeSize	CODE_SIZE
FunctionConfiguration.description	DESCRIPTION
FunctionConfiguration.environment().variables().keySet()	ENVIRONMENT_KEYS (multivalued)
FunctionConfiguration.functionArn	UID
FunctionConfiguration.functionArn	FUNCTION_ARN
FunctionConfiguration.functionName	FUNCTION_NAME
FunctionConfiguration.functionName (falls back to functionArn)	NAME
FunctionConfiguration.handler	HANDLER
FunctionConfiguration.kmsKeyArn	KMS_KEY_ARN
FunctionConfiguration.layers().arn	LAYERS (multivalued)
FunctionConfiguration.memorySize	MEMORY_SIZE_MB
FunctionConfiguration.packageTypeAsString()	PACKAGE_TYPE
FunctionConfiguration.role	ROLE_ARN
FunctionConfiguration.runtimeAsString()	RUNTIME
FunctionConfiguration.stateAsString()	SOURCE_STATUS
FunctionConfiguration.timeout	TIMEOUT_SECONDS
FunctionConfiguration.vpcConfig().securityGroupIds	SECURITY_GROUP_IDS (multivalued)
FunctionConfiguration.vpcConfig().subnetIds	SUBNET_IDS (multivalued)
FunctionConfiguration.vpcConfig().vpcId	VPC_ID
GetFunctionUrlConfigResponse.authTypeAsString()	FUNCTION_URL_AUTH_TYPE
GetFunctionUrlConfigResponse.functionUrl	FUNCTION_URL
GetPolicyResponse.policy	RESOURCE_POLICY
ListTagsResponse.tags	TAGS (multivalued)
sync region	REGION
sync timestamp (Instant.now())	LAST_CAPTURED

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

LambdaFunction

Operation options

Option	Type	Default	Description
region / regions	Comma-separated list of regions to query (one client per region).	All regions from ec2:DescribeRegions
maxResults	Page size (maxItems) for each ListFunctions call.	Shared pageSize configuration (100)

Delta sync

The connector README does not document sync behavior for this object.

API

• Type: AWS SDK for Java v2 (LambdaClient) · Endpoint: lambda:ListFunctions

Changelog

Changelog

The Amazon Lambda connector has undergone the following changes:

Version	Description	Migration Steps
3.2.1	No changes in this release.	N/A
3.2.0	No changes in this release.	N/A
3.1.0	New Features - New connector — syncs Lambda functions with their Function URL and resource policy, including a derived flag identifying unauthenticated public endpoints (Principal:* policies, public Function URLs, etc.). Improvements - Sync failures are now visible. Previously, certain AWS API errors (throttling, server errors, transient network failures, validation errors) could be silently swallowed during multi-region sync, producing empty results without indicating a problem. These now surface as sync failures with a clear log entry detailing the HTTP status, AWS error code, request id, and service name. Per-region permission gaps (HTTP 401 / 403) still allow the sync to continue across other regions, but are now visible in logs.	N/A