Question 1

Is authorization_type enforced for FedRAMP Moderate Baseline Rev 4?

Accepted Answer

Yes, This control verifies that the Lambda function does not have a publicly accessible URL. Exposing services publicly could potentially make sensitive data accessible to malicious actors.

Question 2

Is cloudwatch_logs_kms_key_id enforced for FedRAMP Moderate Baseline Rev 4?

Accepted Answer

Yes, To help protect sensitive data at rest, ensure encryption is enabled for your AWS CloudWatch Log Group.

Question 3

Is cloudwatch_logs_retention_in_days enforced for FedRAMP Moderate Baseline Rev 4?

Accepted Answer

Yes, Ensure a minimum duration of event log data is retained for your log groups to help with troubleshooting and forensics investigations.

Question 4

Is dead_letter_target_arn enforced for FedRAMP Moderate Baseline Rev 4?

Accepted Answer

Yes, Enable this rule to help notify the appropriate personnel through AWS Simple Queue Service (AWS SQS) or AWS Simple Notification Service (AWS SNS) when a function has failed.

Question 5

Is reserved_concurrent_executions enforced for FedRAMP Moderate Baseline Rev 4?

Accepted Answer

Yes, Checks whether the AWS Lambda function is configured with function-level concurrent execution limit. The control is non-compliant if the Lambda function is not configured with function-level concurrent execution limit.

Question 6

Is vpc_security_group_ids enforced for FedRAMP Moderate Baseline Rev 4?

Accepted Answer

Yes, Deploy AWS Lambda functions within an AWS Virtual Private Cloud (AWS VPC) for a secure communication between a function and other services within the AWS VPC.

Question 7

Is vpc_subnet_ids enforced for FedRAMP Moderate Baseline Rev 4?

Accepted Answer

Yes, Deploy AWS Lambda functions within an AWS Virtual Private Cloud (AWS VPC) for a secure communication between a function and other services within the AWS VPC.

AWS Lambda Terraform module

Terraform Module Source