steampipe plugin install awssteampipe plugin install aws

Table: aws_lambda_function

AWS Lambda is a compute service that lets you run code without provisioning or managing servers.

Examples

Basic Info

select
  name,
  arn,
  handler,
  kms_key_arn
from
  aws_lambda_function;

List of lambda functions which are not encrypted with CMK

select
  name,
  kms_key_arn
from
  aws_lambda_function
where
  kms_key_arn is null;

Count of lambda functions by runtime engines

select
  runtime,
  count(*)
from
  aws_lambda_function
group by
  runtime;

List of lambda function whose retention period is less than 30 days

select
  fn.name,
  lg.name,
  lg.retention_in_days
from
  aws_lambda_function as fn
  inner join aws_cloudwatch_log_group as lg on (
    (lg.name = '/aws/lambda/')
    or (lg.name = fn.name)
  )
where
  lg.retention_in_days < 30;

Availability zone count for each VPC lambda function

select
  fn.name,
  fn.region,
  count (availability_zone) as zone_count
from
  aws_lambda_function as fn
  cross join jsonb_array_elements_text(vpc_subnet_ids) as vpc_subnet
  join aws_vpc_subnet as sub on sub.subnet_id = vpc_subnet
group by
  fn.name,
  fn.region
order by
  zone_count;

List all the actions allowed by managed policies for a Lambda execution role

select
  f.name,
  f.role,
  a.action,
  a.access_level,
  a.description
from
  aws_lambda_function as f,
  aws_iam_role as r,
  jsonb_array_elements_text(r.attached_policy_arns) as pol_arn,
  aws_iam_policy as p,
  jsonb_array_elements(p.policy_std -> 'Statement') as stmt,
  jsonb_array_elements_text(stmt -> 'Action') as action_glob,
  glob(action_glob) as action_regex
  join aws_iam_action a ON a.action LIKE action_regex
where
  f.role = r.arn
  and pol_arn = p.arn
  and stmt ->> 'Effect' = 'Allow'
  and f.name = 'hellopython';

List functions not configured with a dead-letter queue

select
  arn,
  dead_letter_config_target_arn
from
  aws_lambda_function
where
  dead_letter_config_target_arn is null;

List runtime settings for each function

select
  name,
  runtime,
  handler,
  architectures
from
  aws_lambda_function;

List URL configuration details for each function

select
  name,
  arn,
  jsonb_pretty(url_config) as url_config
from
  aws_lambda_function;

List functions that have tracing disabled

select
  name,
  arn,
  jsonb_pretty(tracing_config) as tracing_config
from
  aws_lambda_function
where
  tracing_config ->> 'Mode' = 'PassThrough';

Query examples

Control examples

.inspect aws_lambda_function

AWS Lambda Function

Name	Type	Description
_ctx	jsonb	Steampipe context in JSON form, e.g. connection_name.
account_id	text	The AWS Account ID in which the resource is located.
akas	jsonb	Array of globally unique identifier strings (also known as) for the resource.
architectures	jsonb	The instruction set architecture that the function supports. Architecture is a string array with one of the valid values.
arn	text	The function's Amazon Resource Name (ARN).
code	jsonb	The deployment package of the function or version.
code_sha_256	text	The SHA256 hash of the function's deployment package.
code_size	bigint	The size of the function's deployment package, in bytes.
dead_letter_config_target_arn	text	The Amazon Resource Name (ARN) of an Amazon SQS queue or Amazon SNS topic.
description	text	The function's description.
environment_variables	jsonb	The environment variables that are accessible from function code during execution.
file_system_configs	jsonb	Connection settings for an Amazon EFS file system.
handler	text	The function that Lambda calls to begin executing your function.
kms_key_arn	text	The KMS key that's used to encrypt the function's environment variables. This key is only returned if you've configured a customer managed CMK.
last_modified	timestamp with time zone	The date and time that the function was last updated.
last_update_status	text	The status of the last update that was performed on the function.
last_update_status_reason	text	The reason for the last update that was performed on the function.
last_update_status_reason_code	text	The reason code for the last update that was performed on the function.
master_arn	text	For Lambda@Edge functions, the ARN of the master function.
memory_size	bigint	The memory that's allocated to the function.
name	text	The name of the function.
package_type	text	The type of deployment package.
partition	text	The AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov).
policy	jsonb	The resource-based iam policy of Lambda function.
policy_std	jsonb	Contains the policy in a canonical form for easier searching.
region	text	The AWS Region in which the resource is located.
reserved_concurrent_executions	bigint	The number of concurrent executions that are reserved for this function.
revision_id	text	The latest updated revision of the function or alias.
role	text	The function's execution role.
runtime	text	The runtime environment for the Lambda function.
snap_start	jsonb	Set ApplyOn to PublishedVersions to create a snapshot of the initialized execution environment when you publish a function version.
state	text	The current state of the function.
state_reason	text	The reason for the function's current state.
state_reason_code	text	The reason code for the function's current state.
tags	jsonb	A map of tags for the resource.
timeout	text	The amount of time in seconds that Lambda allows a function to run before stopping it.
title	text	Title of the resource.
tracing_config	jsonb	The function's X-Ray tracing configuration.
url_config	jsonb	The function URL configuration details of the function.
version	text	The version of the Lambda function.
vpc_id	text	The VPC ID that is attached to Lambda function.
vpc_security_group_ids	jsonb	A list of VPC security groups IDs attached to Lambda function.
vpc_subnet_ids	jsonb	A list of VPC subnet IDs attached to Lambda function.

turbot/aws

Table: aws_lambda_function

Examples

Basic Info

List of lambda functions which are not encrypted with CMK

Count of lambda functions by runtime engines

List of lambda function whose retention period is less than 30 days

Availability zone count for each VPC lambda function

List all the actions allowed by managed policies for a Lambda execution role

List functions not configured with a dead-letter queue

List runtime settings for each function

List URL configuration details for each function

List functions that have tracing disabled

Query examples

Control examples

.inspect aws_lambda_function

Steampipe

Resources

Community