I am writing a research paper detailing the security vulnerabilities of serverless AWS lambda applications, and how to prevent them. I am also compiling a list of security auditing tools that are designed to target serverless lambda applications.

I am trying to compile an exhaustive list of known lambda specific vulnerabilities, common mistakes (such as AWS lax permission policies), and how to prevent or mitigate against them. So far I have:

  • Remote command injection is possible, particularly if data is not sanitized correctly.

  • Leaked AWS credentials also obviously affect lambda as well, this is a very common mistake (such as credentials stashed in git commits, as demonstrated on flaws.cloud)

  • API Gateway is always publicly accessible, so we need to take the necessary precautions to secure access to our internal APIs, preferably with IAM roles.

  • Lambda costs incurred during a DoS attack ("cost attacks")

  • Functions often are given more permissions than necessary which can lead to compromise
  • Unused functions accidentally, or lazily left around can turn into attack surfaces.
  • From rhino security labs aws writeup:
    • It is possible to pass a new role to a lambda function and then invoke it.
    • It is possible to pass a role to a new Lambda function and trigger it with DynamoDB
    • It is possible to modify the code of an existing lambda function and exploit it

For tools used to audit AWS, so far I have found quite a few:

I am trying to make the list if known Lambda-specific vulnerabilities & common mistakes as exhaustive as possible. Personally I am not terribly experienced with AWS or Lambda, so I wanted to ask those of you in the security community that have real world experience deploying, maintaining, and/or auditing Lambda applications:

  • What are the most common mistakes that administrators make when deploying lambda applications, and how can they be prevented?

  • What are some common vulnerabilities specifically having to do with lambda instances running Python code, and how can they be avoided? (Interested to hear about other languages as well)

  • Has anyone with experience administering lambda encountered a scenario involving any of the vulnerabilities on my list? I would love to hear your story.

  • What else should I add to these lists?

Essentially I am asking for help making these lists as exhaustive as possible; particular the list of vulnerabilities. Real world experience and examples would be much appreciated. The main question is: What am I missing?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.