AWS CloudTrail: Lambda Function Updated with New Layer Attached
Flags CloudTrail UpdateFunctionConfiguration calls that attach Lambda layers to an existing function.
FreeReviewedSigma · Low · v5
- Product
- aws
- Service
- cloudtrail
- Author
- Austin Songer (SigmaHQ), DRL 1.1
- Published
- 2021-09-23
- Updated
- 2026-07-31
What it detects
This rule identifies CloudTrail events where an existing AWS Lambda function configuration is updated to include one or more Lambda layers. Attaching a new layer can allow attacker-controlled code to run under the function, potentially inheriting the IAM role permissions assigned to that function. It relies on AWS CloudTrail telemetry for Lambda UpdateFunctionConfiguration requests and inspects the request parameters for layer entries.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
aws-cloudtrail-detects-lambda-layer-attach-via-updatefunctionconfiguration-97fbabf8
title: "AWS CloudTrail: Lambda Function Updated with New Layer Attached"
id: 5914348f-4de7-4a1e-a3b0-11c4ddb43d3c
status: test
description: This rule identifies CloudTrail events where an existing AWS Lambda function configuration is updated to include one or more Lambda layers. Attaching a new layer can allow attacker-controlled code to run under the function, potentially inheriting the IAM role permissions assigned to that function. It relies on AWS CloudTrail telemetry for Lambda UpdateFunctionConfiguration requests and inspects the request parameters for layer entries.
references:
- https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateFunctionConfiguration.html
- https://github.com/clearvector/lambda-spy
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_new_lambda_layer_attached.yml
author: Austin Songer, Huntrule Team
date: 2021-09-23
modified: 2025-03-17
tags:
- attack.privilege-escalation
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: lambda.amazonaws.com
eventName|startswith: UpdateFunctionConfiguration
requestParameters.layers|contains: "*"
condition: selection
falsepositives:
- Lambda Layer being attached may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
- Lambda Layer being attached from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: low
license: DRL-1.1
related:
- id: 97fbabf8-8e1b-47a2-b7d5-a418d2b95e3d
type: derived