<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: securing-serverless-functions
description: >-
  Harden serverless functions (AWS Lambda, Azure Functions, GCP Cloud Functions) against
  injection, over-permissioned roles, dependency vulnerabilities, and data leakage.
domain: cybersecurity
subdomain: cloud-security
tags:
  - serverless
  - lambda
  - azure-functions
  - cloud-functions
  - injection
  - least-privilege
  - dependency-scanning
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1059.009"]
---

# Securing Serverless Functions

## Overview

Serverless functions introduce unique security challenges: ephemeral compute, implicit
trust in event sources, over-permissioned execution roles, and dependency supply chain
risks. This skill covers hardening Lambda/Azure Functions/Cloud Functions through IAM
scoping, input validation, secret management, dependency scanning, and runtime monitoring.

Mode: `[MODE: ARCHITECT]` — Secure design patterns for serverless.

## Prerequisites

| Requirement | Details |
|---|---|
| AWS Lambda, Azure Functions, or GCP Cloud Functions access | Required |
| IAM permissions for function and role management | Required |
| Python 3.10+ with cloud SDKs | Required |
| Optional | `semgrep`, `bandit`, or `snyk` for static/dependency analysis |

## Key Concepts

### Over-Permissioned Execution Roles

The most common serverless security flaw — functions with admin-level IAM roles:

```bash
# AWS — List Lambda functions and their roles
aws lambda list-functions --query 'Functions[].{Name:FunctionName,Role:Role,Runtime:Runtime}' --output table

# Check what policies a Lambda role has
aws iam list-attached-role-policies --role-name LAMBDA_ROLE
aws iam list-role-policies --role-name LAMBDA_ROLE

# Find Lambda functions with admin access
for func in $(aws lambda list-functions --query 'Functions[].FunctionName' --output text); do
  ROLE=$(aws lambda get-function --function-name "$func" --query 'Configuration.Role' --output text)
  ROLE_NAME=$(echo "$ROLE" | rev | cut -d'/' -f1 | rev)
  POLICIES=$(aws iam list-attached-role-policies --role-name "$ROLE_NAME" --query 'AttachedPolicies[].PolicyName' --output text)
  echo "$POLICIES" | grep -qi "admin" && echo "[CRITICAL] $func has admin policy: $POLICIES"
done
```

### Environment Variable Security

```bash
# AWS — Check for secrets in environment variables
aws lambda list-functions --query 'Functions[].FunctionName' --output text | tr '\t' '\n' | while read func; do
  ENV=$(aws lambda get-function-configuration --function-name "$func" --query 'Environment.Variables' --output json 2>/dev/null)
  echo "$ENV" | grep -iE "(password|secret|key|token|api_key)" && echo "  -> Function: $func"
done

# Proper approach: use Secrets Manager/SSM Parameter Store
aws secretsmanager get-secret-value --secret-id my-app/db-password
aws ssm get-parameter --name /my-app/api-key --with-decryption
```

### Function URL and API Gateway Security

```bash
# List Lambda function URLs (publicly accessible)
aws lambda list-function-url-configs --function-name FUNC | jq '.FunctionUrlConfigs[] | {Url, AuthType}'

# Check for NONE auth type (public access)
for func in $(aws lambda list-functions --query 'Functions[].FunctionName' --output text); do
  URL_CONFIG=$(aws lambda list-function-url-configs --function-name "$func" 2>/dev/null)
  echo "$URL_CONFIG" | jq -e '.FunctionUrlConfigs[] | select(.AuthType == "NONE")' 2>/dev/null && \
    echo "[HIGH] $func has unauthenticated function URL"
done
```

### Dependency Security

```bash
# Scan Python dependencies
pip-audit --requirement requirements.txt --output json

# Scan Node.js dependencies
npm audit --json

# Scan with Snyk
snyk test --json --severity-threshold=high
```

### Runtime Monitoring

```bash
# AWS — Enable Lambda Insights
aws lambda update-function-configuration --function-name FUNC \
  --layers "arn:aws:lambda:us-east-1:580247275435:layer:LambdaInsightsExtension:38"

# Check CloudWatch Logs for suspicious activity
aws logs filter-log-events --log-group-name "/aws/lambda/FUNC" \
  --filter-pattern "ERROR" --start-time $(date -d '24 hours ago' +%s000)
```

## Workflow

### Step 1: Inventory Serverless Functions

```bash
node scripts/agent.js --provider aws --action inventory --output /tmp/serverless_inventory.json
```

### Step 2: Audit Permissions

```bash
node scripts/agent.js --provider aws --action audit --output /tmp/serverless_audit.json
```

### Step 3: Remediate

Apply least-privilege policies, move secrets to Secrets Manager, fix vulnerable dependencies.

## Detection

```yaml
title: Securing Serverless Functions Detection
id: 95d6d491-1a28-4d00-b0a8-1623e7a60fdc
status: experimental
description: Detects suspicious activity related to securing serverless functions techniques in cloud security context
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1059.009
  - attack.credential_access
falsepositives:
  - Automated cloud infrastructure provisioning by approved CI/CD pipelines
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Securing Serverless Functions Detection | aws | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1059.009 |

## Verification

- [ ] All Lambda roles scoped to minimum required permissions
- [ ] No secrets in environment variables (use Secrets Manager/SSM)
- [ ] Function URLs require IAM authentication (not NONE)
- [ ] Dependencies scanned and no critical vulnerabilities
- [ ] VPC-attached functions use private subnets
- [ ] Concurrency limits set to prevent abuse
- [ ] CloudWatch Logs enabled with retention policy
- [ ] Dead letter queues configured for async invocations

## References

- [AWS Lambda Security Best Practices](https://docs.aws.amazon.com/lambda/latest/dg/lambda-security.html)
- [OWASP Serverless Top 10](https://owasp.org/www-project-serverless-top-10/)
- [MITRE ATT&CK T1648 — Serverless Execution](https://attack.mitre.org/techniques/T1648/)
- [Azure Functions Security](https://learn.microsoft.com/en-us/azure/azure-functions/security-concepts)
