Serverless Security: AWS Lambda e Functions

Arquiteturas serverless eliminam gerenciamento de servidores mas introduzem novos desafios: function-level permissions, event injection, dependency vulnerabilities e superfície de ataque expandida.

Modelo de Responsabilidade Compartilhada

OWASP Serverless Top 10

1. Injection Flaws: SQLi, command injection em event data
2. Broken Authentication: Token mismanagement, weak authn
3. Sensitive Data Exposure: Secrets hardcoded, logs verbosos
4. XML External Entities (XXE): XML parsing inseguro
5. Broken Access Control: Overly permissive IAM
6. Security Misconfiguration: Default configs, ports abertos
7. Cross-Site Scripting (XSS): Output encoding inadequado
8. Insecure Deserialization: Deserialização de eventos não confiáveis
9. Using Components with Known Vulnerabilities: Deps desatualizadas
10. Insufficient Logging: Falta de audit trail

IAM e Least Privilege

Cada function deve ter IAM role dedicada com permissões mínimas necessárias.

AWS Lambda - IAM Policy

      {
      "Version": "2012-10-17",
      "Statement": [
      {
      "Effect": "Allow",
      "Action": [
      "dynamodb:GetItem",
      "dynamodb:PutItem"
      ],
      "Resource": "arn:aws:dynamodb:us-east-1:123456789:table/MyTable"
      },
      {
      "Effect": "Allow",
      "Action": [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:*:*:*"
      }
      ]
      }
      

Princípios IAM

• Function-specific roles: Nunca compartilhar roles entre functions
• Resource-level permissions: Especificar ARNs exatos, não wildcards
• Time-based access: Usar AWS STS para credentials temporárias
• Deny by default: Explicitamente allow apenas o necessário

Secrets Management

• AWS Secrets Manager: Rotação automática, encryption at rest
• Azure Key Vault: Managed HSM, access policies
• Environment variables encryption: KMS para encrypt env vars
• Parameter Store: AWS SSM Parameter Store para configs
• Nunca hardcode: Secrets em código ou repositories

Exemplo AWS Lambda + Secrets Manager

      import boto3
      import json
      def lambda_handler(event, context):
      # Buscar secret do Secrets Manager
      session = boto3.session.Session()
      client = session.client(service_name='secretsmanager')
      get_secret_value_response = client.get_secret_value(
      SecretId='prod/db/password'
      )
      secret = json.loads(get_secret_value_response['SecretString'])
      db_password = secret['password']
      # Usar password para conectar ao DB
      # ...
      

Input Validation e Sanitization

Events de API Gateway, S3, DynamoDB Streams, etc. devem ser validados rigorosamente:

      // Node.js Lambda example
      import Joi from 'joi';
      const schema = Joi.object({
      userId: Joi.string().uuid().required(),
      action: Joi.string().valid('create', 'update', 'delete').required(),
      data: Joi.object().required()
      });
      export const handler = async (event) => {
      try {
      const body = JSON.parse(event.body);
      const { error, value } = schema.validate(body);
      if (error) {
      return {
      statusCode: 400,
      body: JSON.stringify({ error: error.details })
      };
      }
      // Process validated input
      // ...
      } catch (e) {
      console.error('Validation error:', e);
      return { statusCode: 400, body: 'Invalid input' };
      }
      };
      

Dependency Management

• SCA tools: Snyk, npm audit, Dependabot
• Minimal dependencies: Reduzir attack surface
• Lock files: package-lock.json, yarn.lock para reproducibility
• Private registries: Host deps aprovadas internamente
• SBOM: Software Bill of Materials para auditability

Timeout e Resource Limits

      # AWS Lambda configuration
      Function:
      Type: AWS::Serverless::Function
      Properties:
      Timeout: 30  # segundos (default 3s, max 900s)
      MemorySize: 512  # MB
      ReservedConcurrentExecutions: 100  # limit concurrency
      Environment:
      Variables:
      MAX_RETRY_ATTEMPTS: 3
      CONNECTION_TIMEOUT: 5000
      

VPC Configuration

Functions que acessam recursos privados devem rodar em VPC com security groups apropriados:

• Private subnets: Functions sem acesso internet direto
• NAT Gateway: Para outbound internet access se necessário
• Security groups: Whitelisting de portas e IPs
• VPC Endpoints: Private access a serviços AWS (S3, DynamoDB)

Logging e Monitoring

Structured Logging

      import { Logger } from '@aws-lambda-powertools/logger';
      const logger = new Logger({ serviceName: 'userService' });
      export const handler = async (event, context) => {
      logger.addContext(context);
      logger.info('Processing request', {
      userId: event.userId,
      requestId: context.requestId
      });
      try {
      // Business logic
      } catch (error) {
      logger.error('Processing failed', { error });
      throw error;
      }
      };
      

API Gateway Security

• Authentication: Cognito, API Keys, Lambda Authorizers
• Rate limiting: Usage plans e throttling
• WAF integration: AWS WAF para proteção contra OWASP Top 10
• Request validation: Models e validators no API Gateway
• CORS: Configurar origins permitidos

Cold Start Security

Cold starts podem ser explorados para timing attacks. Mitigações:

• Provisioned concurrency para functions críticas
• Minimizar package size para startup rápido
• Lazy load de dependencies pesadas
• Warm-up schedules via CloudWatch Events

Runtime Security

• PureSec: Runtime protection para serverless
• Protego: Serverless security platform
• Twistlock: Prisma Cloud para serverless
• Snyk: Vulnerability scanning integrado em CI/CD