<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Auditing Serverless Function Security — API Reference

## AWS Lambda

```bash
# List functions
aws lambda list-functions --query 'Functions[].{Name:FunctionName,Runtime:Runtime,Role:Role}'

# Get function configuration
aws lambda get-function-configuration --function-name FUNC_NAME

# List function URL configs
aws lambda list-function-url-configs --function-name FUNC_NAME

# Get function policy (resource-based)
aws lambda get-policy --function-name FUNC_NAME

# List event source mappings
aws lambda list-event-source-mappings --function-name FUNC_NAME

# Check execution role
aws iam list-attached-role-policies --role-name ROLE_NAME
aws iam list-role-policies --role-name ROLE_NAME
```

## Azure Functions

```bash
# List function apps
az functionapp list --output table

# Check authentication
az webapp auth show --name APP_NAME --resource-group RG

# List app settings
az functionapp config appsettings list --name APP_NAME --resource-group RG

# Check HTTPS only
az functionapp show --name APP_NAME --resource-group RG --query "httpsOnly"

# Check managed identity
az functionapp identity show --name APP_NAME --resource-group RG
```

## GCP Cloud Functions

```bash
# List functions
gcloud functions list

# Describe function
gcloud functions describe FUNC_NAME

# Get IAM policy
gcloud functions get-iam-policy FUNC_NAME

# Set IAM to require auth
gcloud functions remove-iam-policy-binding FUNC_NAME \
  --member=allUsers --role=roles/cloudfunctions.invoker
```

## Security Checklist by Provider

| Check | AWS Lambda | Azure Functions | GCP Cloud Functions |
|-------|-----------|-----------------|---------------------|
| Auth required | AuthType != NONE | Auth enabled | No allUsers binding |
| Least privilege role | No AdministratorAccess | Managed identity | No default SA |
| Secrets management | Secrets Manager | Key Vault refs | Secret Manager |
| VPC integration | VpcConfig set | VNet integration | VPC connector |
| Current runtime | Not deprecated | Not EOL | Not deprecated |
| Logging | CloudWatch Logs | App Insights | Cloud Logging |

## MITRE ATT&CK Mapping

| Technique | ID | Relevance |
|-----------|----|-----------|
| Serverless Execution | T1648 | Abuse of serverless functions |
| Valid Accounts: Cloud | T1078.004 | Stolen function credentials |
| Resource Hijacking | T1496 | Cryptomining via Lambda |
