securing-serverless-functions

# Securing Serverless Functions ## When to Use - When deploying Lambda functions or Azure Functions with access to sensitive data or cloud APIs - When auditing existing serverless workloads for overly permissive IAM roles - When integrating serverless functions into a DevSecOps pipeline with automated security scanning - When hardcoded secrets or vulnerable dependencies are discovered in function code - When establishing runtime monitoring for serverless workloads to detect injection or credential theft **Do not use** for container-based compute security (see securing-kubernetes-on-cloud), for API Gateway configuration (see implementing-cloud-waf-rules), or for serverless architecture design decisions. ## Prerequisites - AWS Lambda, Azure Functions, or GCP Cloud Functions with deployment access - CI/CD pipeline with dependency scanning tools (npm audit, Snyk, Dependabot) - AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault for secrets management - CloudWatch, Application Insights, or Cloud Logging for function monitoring ## Workflow ### Step 1: Enforce Least Privilege IAM Roles Assign each Lambda function a dedicated IAM role with permissions scoped to only the specific resources it accesses. Never share IAM roles across functions. ```bash # Create a least-privilege role for a specific Lambda function aws iam create-role \ --role-name order-processor-lambda-role \ --assume-role-policy-document '{ "Version": "2012-10-17", "Statement": [{ "Effec...