---
name: rt-scenario-c004
description: "C-004: Serverless function code and deployment pipeline security assessment. Domain: cloud. Authorized scenario for function IAM, event validation, secrets handling, dependency risk, and CI/CD controls."
---

# C-004: Serverless Code and Event Injection Risk

## Overview

Serverless functions can become high-impact if event inputs are trusted, deployment roles are overprivileged, secrets are exposed, or dependencies are unreviewed. This scenario assesses the path from function input or pipeline weakness to business impact.

| Field | Value |
|---|---|
| Domain | Cloud / Serverless |
| Objective | Assess function abuse and deployment risk |
| Required Access | Cloud read role and app/API context |
| Detection Risk | Low to Medium |
| Primary Impact | Privileged function misuse or data access |

## Prerequisites

- Functions and triggers in scope.
- Source/deployment pipeline review approved if available.
- Test event source or staging function preferred.
- Secret handling rules.

## Workflow

1. Inventory functions, triggers, runtime, and owners.
2. Review execution roles and environment variables.
3. Review event validation and input parsing.
4. Review deployment permissions and CI/CD approval flow.
5. Review dependencies and runtime patching.
6. Model impact if the function or deployment role is abused.

## Assessment Areas

| Area | Checks |
|---|---|
| IAM | Execution role least privilege. |
| Secrets | Environment variables, secret manager usage, rotation. |
| Triggers | Public HTTP, queues, storage events, scheduled jobs. |
| Input Validation | Schema checks and unsafe dynamic execution. |
| CI/CD | Who can deploy, approve, rollback, and modify env vars. |
| Observability | Logs, alerts, tracing, anomaly detection. |

## MITRE ATT&CK Mapping

| Phase | Tactic | Technique |
|---|---|---|
| Execution | Execution | Serverless Execution |
| Credential Access | Credential Access | Unsecured Credentials |
| Privilege | Privilege Escalation | Cloud Administration Command |

## Evidence

- Function list.
- Role policy summary.
- Trigger map.
- Redacted environment variable names.
- Pipeline permission screenshot.

## Remediation

- Minimize execution roles.
- Move secrets to managed secret stores.
- Validate event schemas.
- Add deployment approvals.
- Scan dependencies.
- Alert on function updates and unusual invocations.

