Lambda Permission Scoped Wildcard Principal
lambda-permission-scoped-wildcard
What this rule checks
Detects Lambda permissions using a wildcard Principal scoped only by a source/org condition.
How to fix it
- 1Prefer naming specific AWS account IDs over Principal "*" with a scoping condition
CDK Insights pinpoints the exact file and line in your CDK source for every finding, so you can jump straight to the fix.
Affected resource types
AWS::Lambda::PermissionAWS::Lambda::LayerVersionPermissionIntentional? Suppress this finding
Sometimes a flag is deliberate — a genuinely public endpoint, say. You can dismiss lambda-permission-scoped-wildcard and the reason is kept in the report, not silently hidden.
In .cdk-insights.json:
{
"ignoreRules": [
{ "id": "lambda-permission-scoped-wildcard", "reason": "Why this is intentional" }
]
}Or inline in your CDK code:
Validations.of(scope).acknowledge({
id: 'cdk-insights::lambda-permission-scoped-wildcard',
reason: 'Why this is intentional',
});Use the rule ID lambda-permission-scoped-wildcard shown above — not the CDK-* ID from SARIF / GitHub code scanning. To dismiss every finding on one construct instead, use ignorePaths. Suppression docs →
Catch this in your stack
$ npx cdk-insights scanCDK Insights runs this and 126+ other rules locally against your synthesised CDK app — free, no account, your code never leaves your machine.