<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-misconfigured-cloud-functions
description: >-
  Detect over-permissioned and misconfigured serverless functions across AWS
  Lambda, GCP Cloud Functions, and Azure Functions including excessive IAM
  roles, public endpoints, missing VPC isolation, and insecure environment
  variable secrets.
domain: cybersecurity
subdomain: cloud-native-security
tags:
  - lambda
  - serverless
  - cloud-functions
  - azure-functions
  - iam
  - misconfiguration
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1059.009"]
---

# Detecting Misconfigured Cloud Functions

## Overview

Serverless functions often accumulate excessive permissions, expose public
endpoints without authentication, store secrets in plaintext environment
variables, and lack VPC isolation. This skill identifies these risks across
AWS Lambda, GCP Cloud Functions, and Azure Functions.

Mode: `[MODE: BLUE]` — Serverless security auditing. `[MODE: RED]` — Serverless attack surface enumeration.

## Prerequisites

| Requirement | Details |
|---|---|
| AWS CLI configured with SecurityAudit or ReadOnlyAccess | Required |
| gcloud CLI authenticated with cloudfunctions.viewer | Required |
| az CLI authenticated | Required |

## Key Concepts

### AWS Lambda Enumeration

```bash
# List all functions
aws lambda list-functions --region us-east-1 --output json

# Check function policy (resource-based)
aws lambda get-policy --function-name FUNCTION_NAME --region us-east-1

# Check execution role permissions
ROLE_ARN=$(aws lambda get-function --function-name FUNC --query 'Configuration.Role' --output text)
aws iam simulate-principal-policy --policy-source-arn "$ROLE_ARN" \
  --action-names "s3:*" "iam:*" "sts:AssumeRole"

# Check for public URL
aws lambda get-function-url-config --function-name FUNCTION_NAME

# Find functions with admin policies
aws lambda list-functions --query 'Functions[].FunctionName' --output text | while read fn; do
  ROLE=$(aws lambda get-function --function-name "$fn" --query 'Configuration.Role' --output text)
  aws iam list-attached-role-policies --role-name "${ROLE##*/}" --output json
done

# Check environment variables for secrets
aws lambda get-function-configuration --function-name FUNC \
  --query 'Environment.Variables' --output json
```

### GCP Cloud Functions

```bash
# List functions
gcloud functions list --format=json

# Check IAM bindings
gcloud functions get-iam-policy FUNCTION_NAME --region=REGION --format=json

# Check for allUsers/allAuthenticatedUsers
gcloud functions get-iam-policy FUNC --format=json | jq '.bindings[] | select(.members[] | contains("allUsers"))'

# Check ingress settings
gcloud functions describe FUNC --region=REGION --format='value(ingressSettings)'
```

### Azure Functions

```bash
# List function apps
az functionapp list --output json

# Check authentication settings
az functionapp auth show --name FUNC_APP --resource-group RG --output json

# Check network restrictions
az functionapp show --name FUNC_APP --resource-group RG --query 'siteConfig.ipSecurityRestrictions'
```

## Workflow

```bash
# Audit all Lambda functions
node scripts/agent.js --provider aws --region us-east-1 --output /tmp/lambda-audit.json

# Review critical findings
cat /tmp/lambda-audit.json | jq '.findings[] | select(.severity == "critical")'
```

## Detection

```yaml
title: Misconfigured Cloud Functions Detection
id: c1e2e653-cb61-446f-8e0d-fa185fca2dfa
status: experimental
description: Detects suspicious activity related to detecting misconfigured cloud functions techniques in cloud native security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1059.009
  - attack.privilege_escalation
falsepositives:
  - Kubernetes controller reconciliation loops during cluster updates
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Misconfigured Cloud Functions Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1059.009 |

## Verification

- [ ] No Lambda functions with wildcard IAM policies (s3:*, iam:*)
- [ ] No public function URLs without authentication
- [ ] Secrets stored in Secrets Manager/SSM, not environment variables
- [ ] Functions deployed within VPCs where accessing internal resources
- [ ] GCP functions have ingress restricted to ALLOW_INTERNAL_ONLY
- [ ] Function timeouts and memory limits configured appropriately

## References

- [AWS Lambda Security Best Practices](https://docs.aws.amazon.com/lambda/latest/dg/security.html)
- [GCP Cloud Functions Security](https://cloud.google.com/functions/docs/securing)
- [OWASP Serverless Top 10](https://owasp.org/www-project-serverless-top-10/)
