serverless-securitylisted

<!-- Native skill bundle for agent-skills (cross-tool convention). Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/serverless-security/SKILL.md. --> # Serverless Security Lambda / Cloud Functions / Azure Functions hardening: IAM, timeouts, secrets, event injection ## ALWAYS - Give each function its own IAM execution role with the minimum permissions needed. Never share roles across functions; never reuse the bootstrap / developer role. - Set a concrete function timeout (≤ 30s for synchronous APIs, ≤ 15min for background jobs). Defaults like 6s or 900s are footguns in different directions. - Set reserved or provisioned concurrency limits per function to avoid bill blow-outs and to keep one noisy tenant from starving the rest of the account. - Pull secrets at cold-start from a secret manager (AWS Secrets Manager / GCP Secret Manager / Azure Key Vault) **with caching**, not from plaintext environment variables. - Validate every event payload against a schema before any code that touches it. Lambda doesn't care that the event arrived from "your" SQS queue — it could be a poison message. - Enable structured logging that redacts known secret patterns (delegate to the `logging-security` skill). - Enable X-Ray / OpenTelemetry tracing and CloudWatch / Cloud Monitoring alerts on error rate, throttle count, duration p95. - Use a VPC for functions that touch a private database or service; otherwise the function gets full outbound