Enhanced AI Application Security Capability 4 · Tools 👤 Customer

c4.7 Constrain Lambda-based tools

When a tool is a Lambda function, scope its execution role, isolate it in a VPC, and cap its resources so a compromised tool has limited reach and cannot exhaust resources.

Foundational

Enhanced

Advanced

Effort: Medium Impact: Medium GenAI scopes: 3 · Pre-trained models; 4 · Fine-tuned models Agentic security dimensions: Operational boundaries

Implementation guidance

How to implement on AWS

Give each Lambda tool an execution role scoped to only the required AWS services, deploy it in a VPC with restrictive security groups, apply resource-based policies to control who can invoke it, encrypt environment variables with a customer managed key, and set timeouts/memory limits.

A Lambda tool is code the agent can trigger

When an agent tool is backed by an AWS Lambda function, the model can cause that code to run with whatever the function's role allows. If the function is over-permissioned, on the public network, or able to scale without limit, a prompt-injection that reaches the tool turns into real actions, lateral movement, or a cost/DoS event. Constrain the function on three axes: identity, network, and resources.

Scope the execution role

Every Lambda has an execution role. Start from AWSLambdaBasicExecutionRole (just CloudWatch Logs) and add only the specific actions this tool needs — nothing broad:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ToolDataAccessOnly",
      "Effect": "Allow",
      "Action": ["dynamodb:GetItem"],
      "Resource": "arn:aws:dynamodb:us-east-1:111122223333:table/Orders"
    }
  ]
}

Combine this with the tool permission boundary (see the tool-roles control) so the effective permissions can never exceed the ceiling.

Put it in a VPC with controlled egress

Run the function in private subnets so it cannot freely reach the internet, and use the security group + a NAT/egress-filtered path to control what it can call:

aws lambda update-function-configuration \
  --function-name agent-tool-lookup-order \
  --vpc-config 'SubnetIds=subnet-0aaa1111,subnet-0bbb2222,SecurityGroupIds=sg-0ccc3333'

Cap its blast radius with reserved concurrency

Reserved concurrency is both a floor and a ceiling — it stops a misused tool from scaling to thousands of parallel executions (runaway cost, downstream exhaustion):

aws lambda put-function-concurrency \
  --function-name agent-tool-lookup-order \
  --reserved-concurrent-executions 10

Also set a short function timeout and minimal memory so a hung or abused invocation is cheap and bounded.

Naming note: replace function name, subnet/SG ids, table ARN, and tune the concurrency limit to the tool's legitimate peak. Reserved concurrency incurs no extra charge.

Acceptance criteria

Lambda tools have scoped execution roles, VPC isolation, resource-based invoke policies, CMK-encrypted env vars, and bounded timeouts/memory.

Practical implementation

How this control is implemented in each reference architecture:

Each Lambda-based tool in the Generative AI account runs with a scoped execution role, VPC isolation, a resource-based invoke policy, CMK-encrypted env vars, and bounded limits.

Give each Lambda tool an execution role scoped to only the AWS services it needs, and deploy it in a VPC with restrictive security groups.

Generative AI account AWS Lambda IAM Amazon VPC
Apply a resource-based policy so only the approved gateway/app can invoke it, and encrypt environment variables with the customer managed key.

Generative AI account AWS Lambda AWS KMS
Set timeouts and memory limits so a runaway tool cannot exhaust resources.

Generative AI account AWS Lambda

How to validate: Lambda tools have scoped execution roles, VPC isolation, resource-based invoke policies, CMK-encrypted env vars, and bounded timeouts/memory.

Avoid: A Lambda tool with a broad role and public invoke rights. A compromised tool then becomes a pivot; scope, isolate, and bound it.

Generative AI OU (multi-account) →

Lambda tools in the account get scoped roles, VPC isolation, resource-based invoke policies, CMK-encrypted env vars, and hard resource limits.

Scope each Lambda tool's execution role to only the required services and run it in a VPC with tight security groups.

Generative AI tier (IAM role) AWS Lambda IAM Amazon VPC
Add a resource-based invoke policy and encrypt env vars with the customer managed key.

Generative AI tier (IAM role) AWS Lambda AWS KMS
Set timeouts and memory limits.

Generative AI tier (IAM role) AWS Lambda

How to validate: Lambda tools have scoped roles, VPC isolation, invoke policies, CMK-encrypted env vars, and bounded limits.

Avoid: Reusing one privileged Lambda role for all tools. Scope and bound each so a single compromise stays small.

Single account (entry point) →

Threats addressed

A compromised low-privilege tool leveraged to reach higher-privilege resources.
Resource exhaustion from unbounded tool execution.

AWS services

AWS Lambda

Amazon VPC

AWS KMS

Pricing

There is no charge for the execution role, reserved concurrency, or placing the function in a VPC (a NAT gateway, if used for egress, bills separately). You pay normal Lambda request + duration charges; capping concurrency and timeout actually protects you from runaway cost. See Configuring reserved concurrency for a function.

Framework mappings

OWASP GenAI/LLM Top 10 (2026)

LLM06 Unbounded Consumption

NIST AI Risk Management Framework (AI 100-1)

MANAGE.1 AI risks are prioritized, responded to and managed

AWS Security Hub — AI Security Best Practices

BedrockAgentCore.7 Bedrock AgentCore custom code interpreters should use a private network configuration

AWS Well-Architected Generative AI Lens (Security)

GENSEC05-BP01 Implement least privilege and permission boundaries for agentic workflows

OWASP GenAI Top 10 for Agentic Applications (2025)

ASI05 Unexpected Code Execution

Learning resources

AWS Lambda security (doc)

References

AWS SRA for AI — Capability 4, AWS Lambda