Threats to the security of our serverless applications take many forms, some are the same old foes we have faced before; some are new; and some have taken on new forms in the serverless world.\n------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------\n\nAs we adopt the serverless paradigm for building cloud-hosted applications, we delegate even more of the operational responsibilities to our cloud providers. When you build a serverless architecture around AWS Lambda you no longer have to configure AMIs, patch the OS, and install daemons to collect and distribute logs and metrics for your application. AWS takes care all of that for you.\n\nWhat does this mean for the [**Shared Responsibility Model**](https://aws.amazon.com/compliance/shared-responsibility-model/) that has long been the cornerstone of security in the AWS cloud?\n\n!(https://hackernoon.com/hn-images/1*6kr67q2FRqMCmJH83DSZpA.png)\n\n### Protection from attacks against the OS\n\nAWS takes over the responsibility for maintaining the host OS as part of their core competency. Hence alleviating you from the rigorous task of applying all the latest security patches — something most of us just don’t do a good enough job of as it’s not our primary focus.\n\nIn doing so, it protects us from attacks against known vulnerabilities in the OS and prevents attacks such as [WannaCry](https://en.wikipedia.org/wiki/WannaCry_ransomware_attack).\n\nAlso, by removing long lived servers from the picture we also removed the threats posed by compromised servers that live in our environment for a long time.\n\n!(https://hackernoon.com/hn-images/1*yxyS9qbLUBOs_28hl5Zj6g.png)\n\nWannaCry happened because the MS17–017 security patch was not applied to the affected hosts.\n\nHowever, it is still our responsibility to patch our application and address vulnerabilities that exist in our code and our dependencies.\n\n### OWASP top 10 is still as relevant as ever\n\n!(https://hackernoon.com/hn-images/1*A-fSGp4uquJNZce9n4-lQg.png)\n\nAside from a few reclassifications the OWASP top 10 list has largely stayed the same in 7 years.\n\nA glance at the [OWASP top 10](https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project) list for 2017 shows us some familiar threats — Injection, Cross-Site Scripting, Sensitive Data Exposure, and so on.\n\n#### A9 — Components with Known Vulnerabilities\n\nWhen the folks at [Snyk](https://snyk.io/) looked at a dataset of 1792 data breaches in 2016 they found that [**12 of the top 50** **data breaches**](https://snyk.io/blog/owasp-top-10-breaches) were caused by applications using components with known vulnerabilities.\n\nFurthermore, [77% of the top 5000 URLs from Alexa include at least one vulnerable library](https://snyk.io/blog/77-percent-of-sites-use-vulnerable-js-libraries). This is less surprising than it first sound when you consider that some of the most popular front-end js frameworks — for example, [jquery](https://snyk.io/vuln/npm:jquery), [Angular](https://snyk.io/vuln/npm:angular) and [React](https://snyk.io/vuln/npm:react) — all had known vulnerabilities. It highlights the need to continuously update and patch your dependencies.\n\nHowever, unlike OS patches which are standalone, trusted and easy to apply, **security updates to these 3rd party dependencies are usually bundled with feature and API changes that need to be integrated and tested**. It makes our life as developers difficult and it’s yet another thing we gotta do when we’re working overtime to ship new features.\n\nAnd then there’s the matter of transient dependencies, and boy there are so many of them… If these transient dependencies have vulnerabilities then you too are vulnerable through your direct dependencies.\n\n!(https://hackernoon.com/hn-images/1*bB9XkUioCbd7TUtM8vQdVQ.png)\n\n[https://david-dm.org/request/request?view=tree](https://david-dm.org/request/request?view=tree)\n\nFinding vulnerabilities in our dependencies is hard work and requires constant diligence, which is why services such as [Snyk](https://snyk.io/) is so useful. It even comes with a built-in [integration with Lambda](https://snyk.io/docs/aws-lambda) too!\n\n#### Attacks against NPM publishers\n\n!(https://media.giphy.com/media/l3JDCo1rx2EISldzq/giphy.gif)\n\nWhat if the author/publisher of your 3rd party dependency is not who you think they are?\n\nJust a few weeks ago, a security bounty hunter posted this [amazing thread](https://github.com/ChALkeR/notes/blob/master/Gathering-weak-npm-credentials.md) on how he managed to gain direct push rights to **14% of NPM packages**. The list of affected packages include some big names too: `debug`, `request`, `react`, `co`, `express`, `moment`, `gulp`, `mongoose`, `mysql`, `bower`, `browserify`, `electron`, `jasmine`, `cheerio`, `modernizr`, `redux` and many more. In total, these packages account for **20% of the total number of monthly downloads from NPM**.\n\n_Let that sink in for a moment._\n\nDid he use highly sophisticated methods to circumvent NPM’s security?\n\nNope, it was a combination of **brute force** and using **known** account & credential leaks from a number of sources including Github. In other words, anyone could have pulled these off with very little research.\n\nIt’s hard not to feel let down by these package authors when so many display such a cavalier attitude towards securing access to their NPM accounts. I feel my trust in these 3rd party dependencies have been betrayed.\n\n> 662 users had password «`123456`», 174 — «`123`», 124 — «`password`».\n\n> 1409 users (1%) used their username as their password, in its original form, without any modifications.\n\n> 11% of users reused their leaked passwords: 10.6% — directly, and 0.7% — with very minor modifications.\n\nAs I [demonstrated in my recent talk](https://www.youtube.com/watch?v=jUhiPj6h_L8&t=800) (see the demo around 13:20 mark of the video) on Serverless security, **one can easily steal temporary AWS credentials from affected Lambda functions (or EC2-hosted Node.js applications) with a few lines of code**.\n\n!(https://i.ytimg.com/vi/jUhiPj6h_L8/hqdefault.jpg)\n\nImagine then, a scenario where an attacker had managed to gain push rights to 14% of all NPM packages. He could publish a patch update to all these packages and steal AWS credentials at a massive scale.\n\nThe stakes are high and it’s quite possibly the biggest security threat we face in the serverless world; and it’s equally threatening to applications hosted in containers or VMs.\n\nThe problems and risks with package management is not specific to the Node.js ecosystem. I have spent most of my career working with .Net technologies and am now working with Scala at Space Ape Games, package management has been a challenge everywhere. Whether or not you’re talking about Nuget or Maven, or whatever package repository, you’re always at risk if the authors of your dependencies do not exercise the same due diligence to secure their accounts as they would their own applications.\n\nOr, perhaps they do…\n\n#### A1 — Injection & A3 — XSS\n\nSQL injection and other forms of injection attacks are still possible in the serverless world, as are cross-site scripting attacks.\n\nEven if you’re using NoSQL databases you might not be exempt from injection attacks either. MongoDB for instance, exposes a number of [attack vectors](https://zanon.io/posts/nosql-injection-in-mongodb) through its query APIs.\n\nArguably DynamoDB’s API makes it hard (at least I haven’t heard of a way yet) for an attacker to orchestrate an injection attack, but you’re still open to other forms of exploits — for example, cross-site scripting (XSS) attacks, and leaked credentials which grants attacker access to DynamoDB tables.\n\nNonetheless, you should always sanitize user inputs, as well as the output from your Lambda functions.\n\n#### A6 — Sensitive Data Exposure\n\nAlong with servers, web frameworks also disappeared when one migrates to the serverless paradigm. These web frameworks have served us well for many years, but they also handed us a loaded gun we can shot ourselves in the foot with.\n\nAs Troy Hunt demonstrated at a recent [talk at the LDNUG](https://skillsmatter.com/skillscasts/9954-london-dot-net-june-meetup), we can accidentally expose all kinds of sensitive data by accidentally leaving directory listing options ON. From `web.config` containing credentials (at 35:28) to SQL backups files (at 1:17:28)!\n\nWith API Gateway and Lambda, accidental exposures like this become very unlikely — directory listing is a “feature” you’d have to implement yourself. It forces you to make very conscious decisions about when to support directory listing and the answer is probably _never_.\n\n### IAM\n\nIf your Lambda functions are compromised, then the next line of defence is to restrict what these compromised functions can do.\n\nThis is why you need to apply the **Least Privilege Principle** when configuring Lambda permissions.\n\nIn the `Serverless` framework, the default behaviour is to use the same IAM role for all functions in the service.\n\nHowever, the `serverless.yml` spec allows you to specify a [different IAM role per function](https://serverless.com/framework/docs/providers/aws/guide/iam/#custom-iam-roles-for-each-function). Although as you can see from the examples it involves a lot more development effort and (from my experience) adds enough friction that almost no one does this…\n\n!(https://hackernoon.com/hn-images/1*T78Ys1ipg_dEFe2_K63R5A.png)\n\nApply per-function IAM policies.\n\n**_update 01/02/2018:_** _thanks to Guy Lichtman, there is a new plugin for the Serverless framework — aptly named_ [serverless-iam-role-per-function](https://github.com/functionalone/serverless-iam-roles-per-function) _— that will make applying per function IAM roles much much easier. It’s very easy to install and use, just follow the instructions on the Github page._\n\n#### IAM policy not versioned with Lambda\n\nA shortcoming with the current Lambda + IAM configuration is that IAM policies are not versioned along with the Lambda function.\n\nIn the scenario where you have multiple versions of the same function in active use (perhaps with different aliases), then it becomes problematic to add or remove permissions:\n\n* adding a new permission to a new version of the function allows old versions of the function additional access that they don’t require (and poses a vulnerability)\n* removing an existing permission from a new version of the function can break old versions of the function that still require that permission\n\nSince the 1.0 release of the `Serverless` framework this has become less a problem as it no longer use aliases for stages — instead, each stage is deployed as a separate function, eg.\n\n* `service-function-dev`\n* `service-function-staging`\n* `service-function-prod`\n\nwhich means it’s far less likely that you’ll _need_ to have multiple versions of the same function in active use.\n\nI also found (from personal experience) **account level isolation** can help mitigate the problems of adding/removing permissions, and crucially, the isolation also helps **compartmentalise security breaches** — eg. a compromised function running in a non-production account cannot be used to cause harm in the production account and impact your users.\n\n!(https://hackernoon.com/hn-images/1*2lyB5B4OydPapmdqbozTSQ.png)\n\nWe can apply the same idea of bulkheads (which has been popularised in the microservices world by Michael Nygard’s “Release It”) and compartmentalise security breaches at an account level.\n\n#### Delete unused functions\n\nOne of the benefits of the serverless paradigm is that you don’t pay for functions when they’re not used.\n\nThe flip side of this property is that you have less need to remove unused functions since they don’t show up on your bill. However, these functions still exist as attack surface, even more so than actively used functions because they’re less likely to be updated and patched. Over time, these unused functions can become a hotbed for components with known vulnerabilities that attackers can exploit.\n\nLambda’s documentations also cites this as one of the [best practices](http://docs.aws.amazon.com/lambda/latest/dg/best-practices.html).\n\n> Delete old Lambda functions that you are no longer using.\n\n### The changing face of DoS attacks\n\nWith AWS Lambda you are far more likely to scale your way out of a DoS attack. However, scaling your serverless architecture aggressively to fight a DoS attack with brute force has a significant cost implication.\n\nNo wonder people started calling DoS attacks against serverless applications **Denial of Wallet (DoW)** attacks!\n\n_“But you can just throttle the no. of concurrent invocations, right?”_\n\nSure, and you end up with a DoS problem instead… it’s a lose-lose situation.\n\nAWS recently introduced [AWS Shield](https://aws.amazon.com/shield/) but at the time of writing the payment protection (only if you pay a monthly flat fee for AWS Shield Advanced) does not cover Lambda costs incurred during a DoS attack.\n\n!(https://hackernoon.com/hn-images/1*XcX3b03mcFcmyVfENHbYPg.png)\n\nFor a monthly flat fee, AWS Shield Advanced gives you cost protection in the event of a DoS attack, but that protection does not cover Lambda yet.\n\nAlso, Lambda has an [**at-least-once** invocation policy](http://docs.aws.amazon.com/lambda/latest/dg/API_Invoke.html). [According to the folks at SunGard](https://blog.sungardas.com/CTOLabs/2017/06/run-lambda-run/), this can result in up to 3 (successful) invocations. From the article, the reported rate of multiple invocations is extremely low — 0.02% — but one wonders if the rate is tied to the load and might manifest itself at a much higher rate during a DoS attack.\n\n!(https://hackernoon.com/hn-images/1*HUDZHb1Ky4S-kQuThh1-Lg.png)\n\nTaken from the “Run, Lambda, Run” article below.\n\nFurthermore, you need to consider how Lambda [retries failed invocations](http://docs.aws.amazon.com/lambda/latest/dg/retries-on-errors.html) by an [asynchronous source](http://docs.aws.amazon.com/lambda/latest/dg/invoking-lambda-function.html) — eg. S3, SNS, SES, CloudWatch Events, etc. Officially, these invocations are retried twice before they’re sent to the assigned DLQ (if any).\n\nHowever, an [analysis](https://engineering.opsgenie.com/aws-lambda-performance-series-part-2-an-analysis-on-async-lambda-fail-retry-behaviour-and-dead-b84620af406) by the OpsGenie guys showed that the no. of retries are not carved in stone and can go up to as many as 6 before the invocation is sent to the DLQ.\n\nIf the DoS attacker is able to trigger failed async invocations (perhaps by uploading files to S3 that will cause your function to except when attempting to process) then they can significantly magnify the impact of their attack.\n\nAll these add up to the potential for the actual no. of Lambda invocations to explode during a DoS attack. As we discussed earlier, whilst your infrastructure might be able to handle the attack, **can your wallet stretch to the same extend**? Should you allow it to?\n\n### Securing external data\n\n!(https://hackernoon.com/hn-images/1*PlSruVB-6fWW2XyO9z-q0w.png)\n\nJust a handful of the places you could be storing state outside of your stateless Lambda function.\n\nDue to the ephemeral nature of Lambda functions, chances are all of your functions are stateless. More than ever, states are stored in external systems and we need to secure them both **at rest** and **in-transit**.\n\nCommunication to all AWS services are via HTTPS and every request needs to be signed and authenticated. A handful of AWS services also offer server-side encryption for your data at rest — [S3](http://amzn.to/1N3Twb8), [RDS](http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html) and [Kinesis streams](http://amzn.to/2tgvFR2) springs to mind, and Lambda has built-in integration with KMS to encrypt your functions’ environment variables.\n\nThe same diligence needs to be applied when storing sensitive data in services/DBs that do not offer built-in encryption — eg. DynamoDB, Elasticsearch, etc. — and ensure they’re protected at rest. In the case of a data breach, it provides another layer of protection for our users’ data.\n\n_We owe our users that much_.\n\nUse secure transport when transmitting data to and from services (both external and internal ones). If you’re building APIs with API Gateway and Lambda then you’re forced to use HTTPS by default, which is a good thing. However, API Gateway is always publicly accessible and you need to take the necessary precautions to secure access to internal APIs.\n\nYou can use API keys but I think it’s better to use [IAM roles](http://docs.aws.amazon.com/apigateway/latest/developerguide/permissions.html). It gives you [fine grained control](http://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-iam-policy-examples-for-api-execution.html) over who can invoke which actions on which resources. Also, using IAM roles spares you from awkward conversations like this:\n\n_“It’s X’s last day, he probably has our API keys on his laptop somewhere, should we rotate the API keys just in case?”_\n\n_“mm.. that’d be a lot of work, X is trustworthy, he’s not gonna do anything.”_\n\n_“ok… if you say so… (secretly pray X doesn’t lose his laptop or develop a belated grudge against the company)”_\n\nFortunately, both can be [easily configured](https://serverless.com/framework/docs/providers/aws/events/apigateway#http-endpoints-with-aws_iam-authorizers) using the `Serverless` framework.\n\n### Leaked credentials\n\n!(https://hackernoon.com/hn-images/1*8wH4JqfvBQmdcQpaROJCog.png)\n\nDon’t become an unwilling bitcoin miner.\n\nThe internet is full of [horror](https://www.theregister.co.uk/2015/01/06/dev_blunder_shows_github_crawling_with_keyslurping_bots/) [stories](https://wptavern.com/ryan-hellyers-aws-nightmare-leaked-access-keys-result-in-a-6000-bill-overnight) of developers racking up a massive AWS bill after their leaked credentials are used by cyber-criminals to mine bitcoins. For every such story many more would have been affected but choose to be silent (for the same reason many security breaches are not announced publicly as big companies do not want to appear incompetent).\n\nEven within my small social circle (\\*sobs) I have heard 2 such incidents, neither were made public and both resulted in over $100k worth of damages. Fortunately, in both cases AWS agreed to cover the cost.\n\nI know for a fact that AWS actively scan public Github repos for active AWS credentials and try to alert you as soon as possible. But as some of the above stories mentioned, even if your credentials were leaked only for a brief window of time it will not escape the watchful gaze of attackers. (plus, they still exist in git commit history unless you rewrite the history too, best to deactivate the credentials if possible).\n\nA good approach to prevent AWS credential leaks is to use git pre-commit hooks as outlined by [this post](https://www.unixdaemon.net/cloud/preventing-aws-creds-in-git-with-pre-commit/).\n\n### Conclusions\n\nWe looked at a number of security threats to our serverless applications in this post, many of them are the same threats that have plighted the software industry for years. All of the OWASP top 10 still apply to us, including SQL, NoSQL and other forms of injection attacks.\n\nLeaked AWS credentials remain a major issue and can potentially impact any organisation that uses AWS. Whilst there are quite a few publicly reported incidents, I have a strong feeling that the actual no. of incidents are much much higher.\n\nWe are still responsible for securing our users’ data both at rest as well as in-transit. API Gateway is always publicly accessible, so we need to take the necessary precautions to secure access to our internal APIs, preferably with IAM roles. IAM offers fine grained control over who can invoke which actions on your API resources, and make it easy to manage access when employees come and go.\n\nOn a positive note, having AWS take over the responsibility for the security of the host OS gives us a no. of security benefits:\n\n* protection against OS attacks because AWS can do a much better job of patching known vulnerabilities in the OS\n* host OS are ephemeral which means no long-lived compromised servers\n* it’s much harder to accidentally leave sensitive data exposed by forgetting to turn off directory listing options in a web framework — because you no longer need such web frameworks!\n\nDoS attacks have taken a new form in the serverless world. Whilst you’re probably able to scale your way out of an attack, it’ll still hurt you in the wallet, hence why DoS attacks have become known in the serverless world as _Denial of Wallet_ attacks. Lambda costs incurred during a DoS attack is **not** **covered** by _AWS Shield Advanced_ at the time of writing, but hopefully they will be in the near future.\n\nMeanwhile, some new attack surfaces have emerged with AWS Lambda:\n\n* functions are often given too much permission because they’re not given individual IAM policies tailored to their needs, a compromised function can therefore do more harm than it might otherwise\n* unused functions are often left around for a long time as there is no cost associated with them, but attackers might be able to exploit them especially if they’re not actively maintained and therefore are likely to contain known vulnerabilities\n\nAbove all, the most worrisome threat for me are attacks against the package authors themselves. It has been shown that many authors do not take the security of their accounts seriously, and as such endangers themselves as well as the rest of the community that depends on them. It’s impossible to guard against such attacks and erodes one of the strongest aspect of any software ecosystem — the community behind it.\n\nOnce again, people have proven to be the weakest link in the security chain.\n\n!(https://hackernoon.com/hn-images/0*b_1R345KzKSaI8sg.png)\n\nHi, my name is **Yan Cui**. I’m an [**AWS Serverless Hero**](https://aws.amazon.com/developer/community/heroes/yan-cui/) and the author of [**Production-Ready Serverless**](https://bit.ly/production-ready-serverless). I have run production workload at scale in AWS for nearly 10 years and I have been an architect or principal engineer with a variety of industries ranging from banking, e-commerce, sports streaming to mobile gaming. I currently work as an independent consultant focused on AWS and serverless.\n\nYou can contact me via [Email](mailto:theburningmonk.com), [Twitter](https://twitter.com/theburningmonk) and [LinkedIn](https://www.linkedin.com/in/theburningmonk/).\n\nCheck out my new course, [**Complete Guide to AWS Step Functions**](https://theburningmonk.thinkific.com/courses/complete-guide-to-aws-step-functions).\n\nIn this course, we’ll cover everything you need to know to use AWS Step Functions service effectively. Including basic concepts, HTTP and event triggers, activities, design patterns and best practices.\n\nGet your copy [here](https://theburningmonk.thinkific.com/courses/complete-guide-to-aws-step-functions).\n\n!(https://hackernoon.com/hn-images/0*ZYcHhOOzUf5VB-Ri.png)\n\nCome learn about operational **BEST PRACTICES** for AWS Lambda: CI/CD, testing & debugging functions locally, logging, monitoring, distributed tracing, canary deployments, config management, authentication & authorization, VPC, security, error handling, and more.\n\nYou can also get **40%** off the face price with the code **ytcui**.\n\nGet your copy [here](https://bit.ly/production-ready-serverless).