Serverless Security: Securing AWS Lambda, Azure Functions & Cloud Functions

The Serverless Security Paradox

Serverless computing eliminates the patching burden — no servers to manage, no OS to update. But it doesn't eliminate security. It shifts the responsibility from infrastructure security to application and configuration security.

Key Shift: In serverless, you don't manage the server, but you still own the code, the configuration, the IAM permissions, and the data flow. These are where 90% of serverless vulnerabilities live.

---

Serverless Threat Model

---

The #1 Serverless Vulnerability: Over-Privileged IAM

Most Lambda functions are deployed with far more permissions than they need:

// BAD — Overly permissive policy (common anti-pattern)
{
  "Effect": "Allow",
  "Action": "*",
  "Resource": "*"
}

// GOOD — Minimum required permissions
{
  "Effect": "Allow",
  "Action": [
    "dynamodb:GetItem",
    "dynamodb:PutItem"
  ],
  "Resource": "arn:aws:dynamodb:us-east-1:123456789:table/UserProfiles"
}

IAM Least-Privilege Rules for Serverless:

1. One IAM role per function (not shared across functions)
2. Specify exact actions (not dynamodb:*)
3. Specify exact resource ARNs (not *)
4. Use conditions (time-based, IP-based, MFA-required where applicable)
5. Audit permissions quarterly with IAM Access Analyzer

---

Event Injection Attacks

Serverless functions are triggered by events from many sources — each one is an input that must be validated:

// VULNERABLE — Trusting S3 event data without validation
export const handler = async (event: S3Event) => {
  const key = event.Records[0].s3.object.key;
  const command = `convert /tmp/${key} /tmp/output.png`;
  exec(command);  // If key = "file; rm -rf /", command injection!
};

// SECURE — Validate and sanitize event data
export const handler = async (event: S3Event) => {
  const key = event.Records[0].s3.object.key;

  // Validate the key matches expected pattern
  if (!/^uploads\/[a-zA-Z0-9_-]+\.(jpg|png|gif)$/.test(key)) {
    throw new Error("Invalid file key");
  }

  // Use safe API instead of shell command
  await sharp(`/tmp/${path.basename(key)}`)
    .resize(800, 600)
    .toFile("/tmp/output.png");
};

---

Serverless Security Best Practices

---

Denial-of-Wallet Attacks

Unlike traditional DDoS (denial of service), serverless enables denial-of-wallet — attackers trigger massive function invocations to run up your cloud bill.

Prevention:

• Set concurrent execution limits per function
• Set AWS account-level concurrency limits
• Implement budget alerts and auto-shutdown at cost thresholds
• Use WAF with rate limiting on API Gateway
• Monitor invocation anomalies (> 10x baseline = alert)

---

Further Reading

• OWASP Serverless Top 10 — Serverless-specific risks
• Cloud Security Guide — Multi-cloud security
• IaC Security — Securing serverless infrastructure as code
• Secrets Management — Don't hardcode secrets in Lambda