<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Cloud Functions Security — API Reference

## AWS Lambda CLI

```bash
# List functions
aws lambda list-functions --region REGION --output json

# Get function configuration
aws lambda get-function-configuration --function-name FUNC --output json

# Get resource-based policy
aws lambda get-policy --function-name FUNC

# Get function URL config
aws lambda get-function-url-config --function-name FUNC

# List event source mappings
aws lambda list-event-source-mappings --function-name FUNC

# Get execution role
aws lambda get-function --function-name FUNC --query 'Configuration.Role'
```

## AWS Lambda Key Fields

| Field | Description |
|-------|-------------|
| `Configuration.Role` | Execution role ARN |
| `Configuration.Environment.Variables` | Environment variables |
| `Configuration.VpcConfig.SubnetIds` | VPC subnet IDs |
| `Configuration.Runtime` | Runtime (python3.12, nodejs20.x) |
| `Configuration.Timeout` | Timeout in seconds |

## GCP Cloud Functions CLI

```bash
# List functions
gcloud functions list --format=json

# Describe function
gcloud functions describe FUNC --region=REGION --format=json

# Get IAM policy
gcloud functions get-iam-policy FUNC --region=REGION --format=json

# Check for public access
gcloud functions get-iam-policy FUNC --format=json | \
  jq '.bindings[] | select(.members[] | contains("allUsers"))'
```

## Azure Functions CLI

```bash
# List function apps
az functionapp list --output json

# Show function app details
az functionapp show --name APP --resource-group RG --output json

# Check auth settings
az functionapp auth show --name APP --resource-group RG

# List function app settings
az functionapp config appsettings list --name APP --resource-group RG
```

## IAM Simulation (AWS)

```bash
# Simulate permissions for Lambda role
aws iam simulate-principal-policy \
  --policy-source-arn ROLE_ARN \
  --action-names "s3:GetObject" "iam:PassRole" "sts:AssumeRole" \
  --output json

# List role policies
aws iam list-attached-role-policies --role-name ROLE_NAME
aws iam list-role-policies --role-name ROLE_NAME
```
