10 steps to Lambda security

AWS Lambda, launched in 2015, is a service which allows customers to create event driven serverless functions of short duration.

Since then Lambda has become amazingly popular, Lambda functions are widely used for many different purposes ranging from low latency web applications and IoT, to AWS account operational and maintenance tasks.

Just like any other application in the cloud, a vulnerable or poorly configured Lambda function can lead to data loss, privilege escalation and even AWS account takeover, see for example this blog post.
​
I’ve created “10 steps to Lambda security” based on my experience of working with customers using AWS Lambda:

1. Use environment variables for configuration details and encrypt with KMS
2. Retrieve sensitive data from DynamoDB, Secrets Manager, or similar service
3. Enable encryption helpers to protect data in transit
4. Configure API Gateway custom domain with SSL cert for web access
5. List minimum specific actions in role policies – not “*”
6. Limit outbound access to Internet to prevent unauthorised data exfiltration
7. Do not use /tmp for sensitive information
8. Application security testing and source code analysis
9. Ensure no vulnerable or unmaintained dependencies
10. Monitor Lambda logs and investigate unusual behaviour

© 2018 Paul Schwarzenberger www.celidor.co.uk May be used with acknowledgement