Security consideration for your Lambda Functions

node_aws_blackbelt_online_seminar_aws_lambda_part4.md

Note: AWS blackbelt online seminar - part4

Security consideration for your Lambda Functions

Speaker: 西谷 圭介, AWS Japan

Security assured by AWS

• EC2 model vs. Firecracker model
  • EC2 model
    • VMs are separated between AWS accounts
    • Lambda's execution environments are shared in a AWS account
  • Firecracker model
    • VMs and Lambda's execution environment are separated between AWS accounts

Security that customers should consider

• TIPS: Asyncronous event source uses intrinsic SQS queue (which is not visible for customers)
• 1 lambda function - 1 IAM Role
• Validate requests
  • if you are using API Gateway, request validation is available
• Do not hard code secret informations, instead:
  • encrypt by KMS
  • store in SSM
  • store in Environment variables
• Run vulneravility scan on the 3rd party dependencies
  • OWASP
  • Synk
  • Twistlock