aws_accessanalyzer_analyzeraws_accountaws_account_alternate_contactaws_account_contactaws_acm_certificateaws_amplify_appaws_api_gateway_api_authorizeraws_api_gateway_api_keyaws_api_gateway_authorizeraws_api_gateway_rest_apiaws_api_gateway_stageaws_api_gateway_usage_planaws_api_gatewayv2_apiaws_api_gatewayv2_domain_nameaws_api_gatewayv2_integrationaws_api_gatewayv2_routeaws_api_gatewayv2_stageaws_appautoscaling_targetaws_appconfig_applicationaws_appstream_imageaws_athena_query_executionaws_athena_workgroupaws_auditmanager_assessmentaws_auditmanager_controlaws_auditmanager_evidenceaws_auditmanager_evidence_folderaws_auditmanager_frameworkaws_availability_zoneaws_backup_frameworkaws_backup_legal_holdaws_backup_planaws_backup_protected_resourceaws_backup_recovery_pointaws_backup_selectionaws_backup_vaultaws_cloudcontrol_resourceaws_cloudformation_stackaws_cloudformation_stack_resourceaws_cloudfront_cache_policyaws_cloudfront_distributionaws_cloudfront_functionaws_cloudfront_origin_access_identityaws_cloudfront_origin_request_policyaws_cloudfront_response_headers_policyaws_cloudsearch_domainaws_cloudtrail_channelaws_cloudtrail_event_data_storeaws_cloudtrail_importaws_cloudtrail_queryaws_cloudtrail_trailaws_cloudtrail_trail_eventaws_cloudwatch_alarmaws_cloudwatch_log_eventaws_cloudwatch_log_groupaws_cloudwatch_log_metric_filteraws_cloudwatch_log_resource_policyaws_cloudwatch_log_streamaws_cloudwatch_log_subscription_filteraws_cloudwatch_metricaws_cloudwatch_metric_data_pointaws_cloudwatch_metric_statistic_data_pointaws_codeartifact_domainaws_codeartifact_repositoryaws_codebuild_buildaws_codebuild_projectaws_codebuild_source_credentialaws_codecommit_repositoryaws_codedeploy_appaws_codedeploy_deployment_configaws_codedeploy_deployment_groupaws_codepipeline_pipelineaws_config_aggregate_authorizationaws_config_configuration_recorderaws_config_conformance_packaws_config_retention_configurationaws_config_ruleaws_cost_by_account_dailyaws_cost_by_account_monthlyaws_cost_by_record_type_dailyaws_cost_by_record_type_monthlyaws_cost_by_service_dailyaws_cost_by_service_monthlyaws_cost_by_service_usage_type_dailyaws_cost_by_service_usage_type_monthlyaws_cost_by_tagaws_cost_forecast_dailyaws_cost_forecast_monthlyaws_cost_usageaws_dax_clusteraws_dax_parameteraws_dax_parameter_groupaws_dax_subnet_groupaws_directory_service_directoryaws_dlm_lifecycle_policyaws_dms_replication_instanceaws_docdb_clusteraws_docdb_cluster_instanceaws_drs_jobaws_drs_recovery_instanceaws_drs_recovery_snapshotaws_drs_source_serveraws_dynamodb_backupaws_dynamodb_global_tableaws_dynamodb_metric_account_provisioned_read_capacity_utilaws_dynamodb_metric_account_provisioned_write_capacity_utilaws_dynamodb_tableaws_dynamodb_table_exportaws_ebs_snapshotaws_ebs_volumeaws_ebs_volume_metric_read_opsaws_ebs_volume_metric_read_ops_dailyaws_ebs_volume_metric_read_ops_hourlyaws_ebs_volume_metric_write_opsaws_ebs_volume_metric_write_ops_dailyaws_ebs_volume_metric_write_ops_hourlyaws_ec2_amiaws_ec2_ami_sharedaws_ec2_application_load_balanceraws_ec2_application_load_balancer_metric_request_countaws_ec2_application_load_balancer_metric_request_count_dailyaws_ec2_autoscaling_groupaws_ec2_capacity_reservationaws_ec2_classic_load_balanceraws_ec2_client_vpn_endpointaws_ec2_gateway_load_balanceraws_ec2_instanceaws_ec2_instance_availabilityaws_ec2_instance_metric_cpu_utilizationaws_ec2_instance_metric_cpu_utilization_dailyaws_ec2_instance_metric_cpu_utilization_hourlyaws_ec2_instance_typeaws_ec2_key_pairaws_ec2_launch_configurationaws_ec2_launch_templateaws_ec2_launch_template_versionaws_ec2_load_balancer_listeneraws_ec2_managed_prefix_listaws_ec2_network_interfaceaws_ec2_network_load_balanceraws_ec2_network_load_balancer_metric_net_flow_countaws_ec2_network_load_balancer_metric_net_flow_count_dailyaws_ec2_regional_settingsaws_ec2_reserved_instanceaws_ec2_spot_priceaws_ec2_ssl_policyaws_ec2_target_groupaws_ec2_transit_gatewayaws_ec2_transit_gateway_routeaws_ec2_transit_gateway_route_tableaws_ec2_transit_gateway_vpc_attachmentaws_ecr_imageaws_ecr_image_scan_findingaws_ecr_repositoryaws_ecrpublic_repositoryaws_ecs_clusteraws_ecs_cluster_metric_cpu_utilizationaws_ecs_cluster_metric_cpu_utilization_dailyaws_ecs_cluster_metric_cpu_utilization_hourlyaws_ecs_container_instanceaws_ecs_serviceaws_ecs_taskaws_ecs_task_definitionaws_efs_access_pointaws_efs_file_systemaws_efs_mount_targetaws_eks_addonaws_eks_addon_versionaws_eks_clusteraws_eks_fargate_profileaws_eks_identity_provider_configaws_eks_node_groupaws_elastic_beanstalk_applicationaws_elastic_beanstalk_environmentaws_elasticache_clusteraws_elasticache_parameter_groupaws_elasticache_redis_metric_cache_hits_hourlyaws_elasticache_redis_metric_curr_connections_hourlyaws_elasticache_redis_metric_engine_cpu_utilization_dailyaws_elasticache_redis_metric_engine_cpu_utilization_hourlyaws_elasticache_redis_metric_get_type_cmds_hourlyaws_elasticache_redis_metric_list_based_cmds_hourlyaws_elasticache_redis_metric_new_connections_hourlyaws_elasticache_replication_groupaws_elasticache_reserved_cache_nodeaws_elasticache_subnet_groupaws_elasticsearch_domainaws_emr_block_public_access_configurationaws_emr_clusteraws_emr_cluster_metric_is_idleaws_emr_instanceaws_emr_instance_fleetaws_emr_instance_groupaws_eventbridge_busaws_eventbridge_ruleaws_fsx_file_systemaws_glacier_vaultaws_globalaccelerator_acceleratoraws_globalaccelerator_endpoint_groupaws_globalaccelerator_listeneraws_glue_catalog_databaseaws_glue_catalog_tableaws_glue_connectionaws_glue_crawleraws_glue_data_catalog_encryption_settingsaws_glue_data_quality_rulesetaws_glue_dev_endpointaws_glue_jobaws_glue_security_configurationaws_guardduty_detectoraws_guardduty_filteraws_guardduty_findingaws_guardduty_ipsetaws_guardduty_memberaws_guardduty_publishing_destinationaws_guardduty_threat_intel_setaws_health_affected_entityaws_health_eventaws_iam_access_advisoraws_iam_access_keyaws_iam_account_password_policyaws_iam_account_summaryaws_iam_actionaws_iam_credential_reportaws_iam_groupaws_iam_policyaws_iam_policy_attachmentaws_iam_policy_simulatoraws_iam_roleaws_iam_saml_provideraws_iam_server_certificateaws_iam_service_specific_credentialaws_iam_useraws_iam_virtual_mfa_deviceaws_identitystore_groupaws_identitystore_useraws_inspector2_coverageaws_inspector2_coverage_statisticsaws_inspector2_findingaws_inspector2_memberaws_inspector_assessment_runaws_inspector_assessment_targetaws_inspector_assessment_templateaws_inspector_exclusionaws_inspector_findingaws_kinesis_consumeraws_kinesis_firehose_delivery_streamaws_kinesis_streamaws_kinesis_video_streamaws_kinesisanalyticsv2_applicationaws_kms_aliasaws_kms_keyaws_lambda_aliasaws_lambda_functionaws_lambda_function_metric_duration_dailyaws_lambda_function_metric_errors_dailyaws_lambda_function_metric_invocations_dailyaws_lambda_layeraws_lambda_layer_versionaws_lambda_versionaws_lightsail_instanceaws_macie2_classification_jobaws_media_store_containeraws_mgn_applicationaws_msk_clusteraws_msk_serverless_clusteraws_neptune_db_clusteraws_networkfirewall_firewallaws_networkfirewall_firewall_policyaws_networkfirewall_rule_groupaws_oam_linkaws_oam_sinkaws_opensearch_domainaws_organizations_accountaws_organizations_policyaws_pinpoint_appaws_pipes_pipeaws_pricing_productaws_pricing_service_attributeaws_ram_principal_associationaws_ram_resource_associationaws_rds_db_clusteraws_rds_db_cluster_parameter_groupaws_rds_db_cluster_snapshotaws_rds_db_event_subscriptionaws_rds_db_instanceaws_rds_db_instance_automated_backupaws_rds_db_instance_metric_connectionsaws_rds_db_instance_metric_connections_dailyaws_rds_db_instance_metric_connections_hourlyaws_rds_db_instance_metric_cpu_utilizationaws_rds_db_instance_metric_cpu_utilization_dailyaws_rds_db_instance_metric_cpu_utilization_hourlyaws_rds_db_instance_metric_read_iopsaws_rds_db_instance_metric_read_iops_dailyaws_rds_db_instance_metric_read_iops_hourlyaws_rds_db_instance_metric_write_iopsaws_rds_db_instance_metric_write_iops_dailyaws_rds_db_instance_metric_write_iops_hourlyaws_rds_db_option_groupaws_rds_db_parameter_groupaws_rds_db_proxyaws_rds_db_snapshotaws_rds_db_subnet_groupaws_rds_reserved_db_instanceaws_redshift_clusteraws_redshift_cluster_metric_cpu_utilization_dailyaws_redshift_event_subscriptionaws_redshift_parameter_groupaws_redshift_snapshotaws_redshift_subnet_groupaws_redshiftserverless_namespaceaws_redshiftserverless_workgroupaws_regionaws_resource_explorer_indexaws_resource_explorer_searchaws_resource_explorer_supported_resource_typeaws_route53_domainaws_route53_health_checkaws_route53_recordaws_route53_resolver_endpointaws_route53_resolver_ruleaws_route53_traffic_policyaws_route53_traffic_policy_instanceaws_route53_zoneaws_s3_access_pointaws_s3_account_settingsaws_s3_bucketaws_s3_multi_region_access_pointaws_s3_objectaws_sagemaker_appaws_sagemaker_domainaws_sagemaker_endpoint_configurationaws_sagemaker_modelaws_sagemaker_notebook_instanceaws_sagemaker_training_jobaws_secretsmanager_secretaws_securityhub_action_targetaws_securityhub_findingaws_securityhub_finding_aggregatoraws_securityhub_hubaws_securityhub_insightaws_securityhub_memberaws_securityhub_productaws_securityhub_standards_controlaws_securityhub_standards_subscriptionaws_securitylake_data_lakeaws_securitylake_subscriberaws_serverlessapplicationrepository_applicationaws_service_discovery_instanceaws_service_discovery_namespaceaws_service_discovery_serviceaws_servicecatalog_portfolioaws_servicecatalog_productaws_servicequotas_default_service_quotaaws_servicequotas_service_quotaaws_servicequotas_service_quota_change_requestaws_ses_domain_identityaws_ses_email_identityaws_sfn_state_machineaws_sfn_state_machine_executionaws_sfn_state_machine_execution_historyaws_simspaceweaver_simulationaws_sns_topicaws_sns_topic_subscriptionaws_sqs_queueaws_ssm_associationaws_ssm_documentaws_ssm_document_permissionaws_ssm_inventoryaws_ssm_inventory_entryaws_ssm_maintenance_windowaws_ssm_managed_instanceaws_ssm_managed_instance_complianceaws_ssm_managed_instance_patch_stateaws_ssm_parameteraws_ssm_patch_baselineaws_ssoadmin_account_assignmentaws_ssoadmin_instanceaws_ssoadmin_managed_policy_attachmentaws_ssoadmin_permission_setaws_sts_caller_identityaws_tagging_resourceaws_vpcaws_vpc_customer_gatewayaws_vpc_dhcp_optionsaws_vpc_egress_only_internet_gatewayaws_vpc_eipaws_vpc_eip_address_transferaws_vpc_endpointaws_vpc_endpoint_serviceaws_vpc_flow_logaws_vpc_flow_log_eventaws_vpc_internet_gatewayaws_vpc_nat_gatewayaws_vpc_network_aclaws_vpc_peering_connectionaws_vpc_routeaws_vpc_route_tableaws_vpc_security_groupaws_vpc_security_group_ruleaws_vpc_subnetaws_vpc_verified_access_endpointaws_vpc_verified_access_groupaws_vpc_verified_access_instanceaws_vpc_verified_access_trust_provideraws_vpc_vpn_connectionaws_vpc_vpn_gatewayaws_waf_rate_based_ruleaws_waf_ruleaws_waf_rule_groupaws_waf_web_aclaws_wafregional_ruleaws_wafregional_rule_groupaws_wafregional_web_aclaws_wafv2_ip_setaws_wafv2_regex_pattern_setaws_wafv2_rule_groupaws_wafv2_web_aclaws_wellarchitected_answeraws_wellarchitected_check_detailaws_wellarchitected_check_summaryaws_wellarchitected_consolidated_reportaws_wellarchitected_lensaws_wellarchitected_lens_reviewaws_wellarchitected_lens_review_improvementaws_wellarchitected_lens_review_reportaws_wellarchitected_lens_shareaws_wellarchitected_milestoneaws_wellarchitected_notificationaws_wellarchitected_share_invitationaws_wellarchitected_workloadaws_wellarchitected_workload_shareaws_workspaces_workspace
Table: aws_lambda_function
AWS Lambda is a compute service that lets you run code without provisioning or managing servers.
Examples
Basic Info
select name, arn, handler, kms_key_arnfrom aws_lambda_function;
List of lambda functions which are not encrypted with CMK
select name, kms_key_arnfrom aws_lambda_functionwhere kms_key_arn is null;
Count of lambda functions by runtime engines
select runtime, count(*)from aws_lambda_functiongroup by runtime;
List of lambda function whose retention period is less than 30 days
select fn.name, lg.name, lg.retention_in_daysfrom aws_lambda_function as fn inner join aws_cloudwatch_log_group as lg on ( (lg.name = '/aws/lambda/') or (lg.name = fn.name) )where lg.retention_in_days < 30;
Availability zone count for each VPC lambda function
select fn.name, fn.region, count (availability_zone) as zone_countfrom aws_lambda_function as fn cross join jsonb_array_elements_text(vpc_subnet_ids) as vpc_subnet join aws_vpc_subnet as sub on sub.subnet_id = vpc_subnetgroup by fn.name, fn.regionorder by zone_count;
List all the actions allowed by managed policies for a Lambda execution role
select f.name, f.role, a.action, a.access_level, a.descriptionfrom aws_lambda_function as f, aws_iam_role as r, jsonb_array_elements_text(r.attached_policy_arns) as pol_arn, aws_iam_policy as p, jsonb_array_elements(p.policy_std -> 'Statement') as stmt, jsonb_array_elements_text(stmt -> 'Action') as action_glob, glob(action_glob) as action_regex join aws_iam_action a ON a.action LIKE action_regexwhere f.role = r.arn and pol_arn = p.arn and stmt ->> 'Effect' = 'Allow' and f.name = 'hellopython';
List functions not configured with a dead-letter queue
select arn, dead_letter_config_target_arnfrom aws_lambda_functionwhere dead_letter_config_target_arn is null;
List runtime settings for each function
select name, runtime, handler, architecturesfrom aws_lambda_function;
List URL configuration details for each function
select name, arn, jsonb_pretty(url_config) as url_configfrom aws_lambda_function;
List functions that have tracing disabled
select name, arn, jsonb_pretty(tracing_config) as tracing_configfrom aws_lambda_functionwhere tracing_config ->> 'Mode' = 'PassThrough';
Query examples
- iam_roles_for_lambda_function
- kms_keys_for_lambda_function
- lambda_function_by_account
- lambda_function_by_region
- lambda_function_by_runtime
- lambda_function_code_size_by_account
- lambda_function_code_size_by_region
- lambda_function_code_size_by_runtime
- lambda_function_count
- lambda_function_encryption
- lambda_function_encryption_table
- lambda_function_input
- lambda_function_memory
- lambda_function_memory_size_by_account
- lambda_function_memory_size_by_region
- lambda_function_memory_size_by_runtime
- lambda_function_overview
- lambda_function_policy
- lambda_function_public
- lambda_function_public_access_table
- lambda_function_public_count
- lambda_function_runtime
- lambda_function_security_groups
- lambda_function_subnet_ids
- lambda_function_tags
- lambda_function_unencrypted_count
- lambda_functions_for_api_gatewayv2_api
- lambda_functions_for_cloudwatch_log_group
- lambda_functions_for_iam_role
- lambda_functions_for_kms_key
- lambda_functions_for_sqs_queue
- lambda_functions_for_vpc
- lambda_functions_for_vpc_security_group
- lambda_functions_for_vpc_subnet
- policy_std_for_lambda_function
- vpc_security_group_assoc
- vpc_security_group_egress_rule_sankey
- vpc_security_group_ingress_rule_sankey
- vpc_security_groups_for_lambda_function
- vpc_subnet_association
- vpc_subnets_for_lambda_function
- vpc_vpcs_for_lambda_function
Control examples
- lambda_function_expected_tag_values
- lambda_function_mandatory
- lambda_function_prohibited
- lambda_function_tag_limit
- lambda_function_untagged
- lambda_function_in_vpc
- lambda_function_policy_prohibit_public_access
- lambda_function_excessive_timeout
- lambda_function_high_error_rate
- lambda_function_with_graviton2
- lambda_function_cloudtrail_logging_enabled
- lambda_function_concurrent_execution_limit_configured
- lambda_function_cors_configuration
- lambda_function_dead_letter_queue_configured
- lambda_function_in_vpc
- lambda_function_multiple_az_configured
- lambda_function_restrict_public_access
- lambda_function_tracing_enabled
- lambda_function_use_latest_runtime
- lambda_function_by_encryption_status
- lambda_function_dead_letter_config_status
- lambda_function_last_update_status
- lambda_function_public_status
- lambda_function_uses_latest_runtime_status
.inspect aws_lambda_function
AWS Lambda Function
Name | Type | Description |
---|---|---|
_ctx | jsonb | Steampipe context in JSON form, e.g. connection_name. |
account_id | text | The AWS Account ID in which the resource is located. |
akas | jsonb | Array of globally unique identifier strings (also known as) for the resource. |
architectures | jsonb | The instruction set architecture that the function supports. Architecture is a string array with one of the valid values. |
arn | text | The function's Amazon Resource Name (ARN). |
code | jsonb | The deployment package of the function or version. |
code_sha_256 | text | The SHA256 hash of the function's deployment package. |
code_size | bigint | The size of the function's deployment package, in bytes. |
dead_letter_config_target_arn | text | The Amazon Resource Name (ARN) of an Amazon SQS queue or Amazon SNS topic. |
description | text | The function's description. |
environment_variables | jsonb | The environment variables that are accessible from function code during execution. |
file_system_configs | jsonb | Connection settings for an Amazon EFS file system. |
handler | text | The function that Lambda calls to begin executing your function. |
kms_key_arn | text | The KMS key that's used to encrypt the function's environment variables. This key is only returned if you've configured a customer managed CMK. |
last_modified | timestamp with time zone | The date and time that the function was last updated. |
last_update_status | text | The status of the last update that was performed on the function. |
last_update_status_reason | text | The reason for the last update that was performed on the function. |
last_update_status_reason_code | text | The reason code for the last update that was performed on the function. |
master_arn | text | For Lambda@Edge functions, the ARN of the master function. |
memory_size | bigint | The memory that's allocated to the function. |
name | text | The name of the function. |
package_type | text | The type of deployment package. |
partition | text | The AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov). |
policy | jsonb | The resource-based iam policy of Lambda function. |
policy_std | jsonb | Contains the policy in a canonical form for easier searching. |
region | text | The AWS Region in which the resource is located. |
reserved_concurrent_executions | bigint | The number of concurrent executions that are reserved for this function. |
revision_id | text | The latest updated revision of the function or alias. |
role | text | The function's execution role. |
runtime | text | The runtime environment for the Lambda function. |
snap_start | jsonb | Set ApplyOn to PublishedVersions to create a snapshot of the initialized execution environment when you publish a function version. |
state | text | The current state of the function. |
state_reason | text | The reason for the function's current state. |
state_reason_code | text | The reason code for the function's current state. |
tags | jsonb | A map of tags for the resource. |
timeout | text | The amount of time in seconds that Lambda allows a function to run before stopping it. |
title | text | Title of the resource. |
tracing_config | jsonb | The function's X-Ray tracing configuration. |
url_config | jsonb | The function URL configuration details of the function. |
version | text | The version of the Lambda function. |
vpc_id | text | The VPC ID that is attached to Lambda function. |
vpc_security_group_ids | jsonb | A list of VPC security groups IDs attached to Lambda function. |
vpc_subnet_ids | jsonb | A list of VPC subnet IDs attached to Lambda function. |