Lambda Security
Compute & ServerlessLambda Security covers the practices and configurations needed to run serverless functions securely. Each Lambda function has an execution role that defines what AWS services and resources the function can access.
Key Security Controls
- Execution Role: apply least-privilege IAM policies; never use
AdministratorAccess - Resource-based Policy: controls who/what can invoke the function
- Function URL Authentication: use
AWS_IAMauth type, notNONE(which makes it public) - VPC Placement: place functions in a VPC to access private resources; requires ENI permissions
- Code Signing: ensures only trusted code packages are deployed
- Environment Variables: encrypt sensitive values with KMS; never store secrets in plaintext
- Reserved Concurrency: prevents a single function from consuming all account concurrency
Common Risks
- Overly permissive execution roles (e.g.,
s3:*instead ofs3:GetObjecton a specific bucket) - Public function URLs without authentication
- Secrets hardcoded in environment variables without encryption
- Event injection through untrusted event sources
Related Content
Related Terms
The security principle of granting only the minimum permissions needed to perform a task - no more, no less.
An AWS identity with temporary credentials that can be assumed by users, services, or applications to perform actions without long-term access keys.
The practice of securely storing, accessing, and rotating sensitive data like API keys, database passwords, and tokens using services like AWS Secrets Manager.
An isolated virtual network within AWS where you launch resources, with full control over IP addressing, subnets, route tables, and network gateways.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.