Lesson 24-Serverless Security

Serverless Security Threats

Function Permission Abuse

Threat Scenarios:

  • Excessive permissions lead to lateral movement attacks
  • Malicious code executes privileged operations
  • Improper function calls form attack chains

Typical Cases:

  • In 2020, a company’s Lambda function with excessive IAM permissions was exploited, leading to data breaches
  • Attackers injected malicious code by polluting environment variables

Defense Measures:

(1) Principle of Least Privilege

# serverless.yml IAM permission configuration example
provider:
  iamRoleStatements:
    - Effect: Allow
      Action:
        - dynamodb:GetItem
        - dynamodb:PutItem
      Resource: "arn:aws:dynamodb:us-east-1:123456789012:table/Orders"
    - Effect: Allow
      Action:
        - logs:CreateLogGroup
        - logs:CreateLogStream
        - logs:PutLogEvents
      Resource: "*"

Optimization Techniques:

  1. Use serverless-pseudo-parameters plugin to dynamically reference resources
  2. Validate permission policies with AWS IAM Access Analyzer
  3. Regularly audit and tighten permissions

(2) Environment Variable Security

// Securely load environment variables
require('dotenv').config({ path: '../.env.production' });

// Encrypt sensitive information
const encryptedSecret = process.env.ENCRYPTED_SECRET;
const decrypted = decryptWithKMS(encryptedSecret);

Security Recommendations:

  • Disable direct configuration of AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
  • Use AWS Secrets Manager to manage sensitive information
  • Encrypt environment variables for storage

Data Leakage Risks

Threat Scenarios:

  • Unencrypted data transmission
  • Sensitive data inadvertently logged
  • Insecure API responses exposing data

Typical Cases:

  • In 2019, a company’s API Gateway misconfiguration returned the entire user database
  • Logging credit card numbers led to PCI DSS violations

Defense Measures:

(1) Data Transmission Encryption

# API Gateway HTTPS enforcement configuration
provider:
  apiGateway:
    binaryMediaTypes:
      - '*/*'
    minimumCompressionSize: 0
    endpointConfiguration:
      types:
        - REGIONAL

Security Configurations:

  1. Enforce HTTPS (redirect HTTP to HTTPS)
  2. Enable TLS 1.2+ encryption
  3. Configure HSTS headers

(2) Data Storage Encryption

// KMS encryption example
const AWS = require('aws-sdk');
const kms = new AWS.KMS();

async function encryptData(data) {
  const params = {
    KeyId: process.env.KMS_KEY_ID,
    Plaintext: data
  };
  const { CiphertextBlob } = await kms.encrypt(params).promise();
  return CiphertextBlob.toString('base64');
}

Encryption Strategies:

  • Static data: Use KMS or SSE encryption
  • Data in transit: TLS 1.2+
  • Sensitive fields: Application-layer encryption

(3) Log Security

# serverless.yml log configuration
provider:
  logging:
    http: true
    level: INFO
    exclude:
      - "password"
      - "credit_card"

Log Handling Recommendations:

  1. Implement structured logging
  2. Sanitize sensitive data
  3. Control log access
  4. Regularly audit logs

DDoS and Cold Start Attacks

Threat Scenarios:

  • API-layer DDoS attacks causing service unavailability
  • Malicious requests triggering cold start storms
  • Resource exhaustion attacks

Typical Cases:

  • In 2021, an API Gateway without rate limiting was paralyzed by a DDoS attack
  • Attackers triggered cold starts with high-frequency calls, causing service delays

Defense Measures:

(1) DDoS Protection

# CloudFront DDoS protection configuration
resources:
  Resources:
    CloudFrontDistribution:
      Type: AWS::CloudFront::Distribution
      Properties:
        DistributionConfig:
          ViewerCertificate:
            CloudFrontDefaultCertificate: true
          HttpVersion: http2
          PriceClass: PriceClass_100
          WebACLId: !Ref WAFWebACL

Protection Strategies:

  1. Use AWS Shield Advanced
  2. Configure WAF rules (rate limiting, IP blacklisting)
  3. Enable CloudFront caching

(2) Cold Start Mitigation

# Provisioned Concurrency configuration
provider:
  provisionedConcurrency: 5 # Number of pre-warmed instances

Optimization Solutions:

  1. Use Provisioned Concurrency to maintain active instances
  2. Implement health check endpoints
  3. Optimize initialization code (lazy loading)
  4. Use Lambda@Edge to preprocess requests

Security Design

IAM Permission Management

Design Principles:

  • Principle of least privilege
  • Separation of duties
  • Permission auditing

Implementation Example:

# serverless.yml IAM configuration
provider:
  iamRoleStatements:
    - Effect: Allow
      Action:
        - s3:GetObject
        - s3:PutObject
      Resource: "arn:aws:s3:::my-bucket/*"
    - Effect: Deny
      Action:
        - s3:DeleteObject
      Resource: "*"

Best Practices:

  1. Validate policies with AWS IAM Access Analyzer
  2. Implement permission boundaries
  3. Regularly rotate IAM credentials
  4. Use Service Control Policies (SCPs) to restrict account permissions

Data Encryption and Signing

Encryption Layers:

  1. Transport Layer: TLS 1.2+
  2. Storage Layer: KMS/SSE
  3. Application Layer: Field-level encryption

Implementation Example:

// KMS encryption/decryption example
const AWS = require('aws-sdk');
const kms = new AWS.KMS();

async function encryptField(data) {
  const params = {
    KeyId: process.env.KMS_KEY_ID,
    Plaintext: data
  };
  const { CiphertextBlob } = await kms.encrypt(params).promise();
  return CiphertextBlob.toString('base64');
}

async function decryptField(encryptedData) {
  const params = {
    CiphertextBlob: Buffer.from(encryptedData, 'base64')
  };
  const { Plaintext } = await kms.decrypt(params).promise();
  return Plaintext.toString('utf-8');
}

Signing Implementation:

// Request signing example
const crypto = require('crypto');

function signRequest(data, secret) {
  return crypto
    .createHmac('sha256', secret)
    .update(JSON.stringify(data))
    .digest('hex');
}

VPC and Network Isolation

VPC Configuration Example:

# serverless.yml VPC configuration
provider:
  vpc:
    securityGroupIds:
      - sg-12345678
    subnetIds:
      - subnet-12345678
      - subnet-87654321

Network Isolation Strategies:

  1. Public Subnets: API Gateway/NAT Gateway
  2. Private Subnets: Databases/internal services
  3. Security Groups: Minimal open port principle

VPC Best Practices:

  1. Use NAT Gateway instead of NAT Instance
  2. Configure VPC Flow Logs to monitor traffic
  3. Implement network ACL restrictions
  4. Use PrivateLink for VPC endpoint connections

Security Best Practices

Function Least Privilege Principle

Implementation Steps:

  1. Divide Lambda execution roles by function
  2. Use AWS IAM Policy conditions to restrict access
  3. Regularly audit permission usage

Example Policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:Query"
      ],
      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders",
      "Condition": {
        "ForAllValues:StringEquals": {
          "dynamodb:LeadingKeys": ["${aws:userid}"]
        }
      }
    }
  ]
}

Permission Optimization Tools:

  • AWS IAM Access Analyzer
  • Policy Sentry
  • Cloud Custodian

API Authentication and Authorization (JWT/OAuth)

JWT Verification Example:

const jwt = require('jsonwebtoken');

async function authenticate(event) {
  const token = event.headers.Authorization?.split(' ')[1];
  if (!token) throw new Error('Unauthorized');
  
  try {
    const decoded = jwt.verify(token, process.env.JWT_PUBLIC_KEY);
    return decoded;
  } catch (err) {
    throw new Error('Invalid token');
  }
}

OAuth2 Implementation:

const axios = require('axios');

async function getAccessToken() {
  const response = await axios.post('https://auth.example.com/oauth/token', {
    grant_type: 'client_credentials',
    client_id: process.env.CLIENT_ID,
    client_secret: process.env.CLIENT_SECRET
  });
  return response.data.access_token;
}

Authorization Strategies:

  1. Role-Based Access Control (RBAC)
  2. Attribute-Based Access Control (ABAC)
  3. OAuth2 Scope restrictions

Logging and Security Auditing

Structured Logging Example:

// Structured logging
const winston = require('winston');

const logger = winston.createLogger({
  level: 'info',
  format: winston.format.json(),
  transports: [
    new winston.transports.Console(),
    new winston.transports.File({ filename: 'app.log' })
  ]
});

function logRequest(event) {
  logger.info('API Request', {
    path: event.path,
    method: event.httpMethod,
    headers: redactHeaders(event.headers),
    queryStringParameters: event.queryStringParameters
  });
}

Security Audit Key Points:

  1. Log all API calls and response statuses
  2. Record IAM permission usage
  3. Log sensitive operations (data modification, deletion)
  4. Implement log rotation and retention policies

Log Analysis Tools:

  • AWS CloudWatch Logs Insights
  • ELK Stack (Elasticsearch, Logstash, Kibana)
  • Splunk

Comprehensive Security Strategies

Secure Development Lifecycle (SDL)

SDL Phases:

  1. Requirements Analysis: Identify security requirements
  2. Design: Security architecture review
  3. Development: Secure coding standards
  4. Testing: Security testing (penetration testing, SAST/DAST)
  5. Deployment: Security configuration checks
  6. Operations: Continuous monitoring and response

Toolchain:

  • Static Analysis: ESLint, Bandit
  • Dynamic Analysis: OWASP ZAP, Burp Suite
  • Dependency Scanning: Snyk, Dependabot

Security Monitoring and Response

Monitoring Metrics:

  • Anomalous API call patterns
  • Abnormal permission usage
  • Data access anomalies
  • Network traffic anomalies

Response Process:

  1. Detect security incident
  2. Isolate affected resources
  3. Collect evidence (logs, network traffic)
  4. Analyze root cause
  5. Implement remediation measures
  6. Restore services
  7. Conduct post-incident analysis (write report, improve processes)

Compliance Assurance

Common Compliance Standards:

  • GDPR (Data Protection)
  • HIPAA (Healthcare Data)
  • PCI DSS (Payment Card Industry)
  • SOC 2 (Trust Services)

Compliance Implementation Recommendations:

  1. Data classification and grading
  2. Access control auditing
  3. Data encryption in transit and at rest
  4. Security incident response plan
  5. Regular compliance audits

Course: Micro Frontends & Serverless: Modular Web Development
Share your love

Trending now

Exploring Web 3D Core Technologies Development
Assembly Language Programming From Low-Level Logic to System Kernel
WebRTC Advanced Guide：Media, Transport & Architecture
WebSocket Deep Guide：Building High-Performance Realtime Systems