securing-serverless-functions

name	securing-serverless-functions
description	Use when this skill covers security hardening for serverless compute platforms including AWS Lambda, Azure Functions, and Google Cloud Functions. It addresses least privilege IAM roles, dependency vulnerability scanning, secrets management integration, input validation, function URL authentication, and runtime monitoring to protect against injection attacks, credential theft, and supply chain compromises.
domain	cybersecurity
tags	["serverless-security","aws-lambda","azure-functions","function-hardening","supply-chain"]
subdomain	cloud-security
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]

Securing Serverless Functions

Overview

Cybersecurity skill for securing serverless functions. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "securing serverless functions"

• "This skill covers security hardening for serverless compute platforms including "

• When deploying Lambda functions or Azure Functions with access to sensitive data or cloud APIs

• When auditing existing serverless workloads for overly permissive IAM roles

• When integrating serverless functions into a DevSecOps pipeline with automated security scanning

• When hardcoded secrets or vulnerable dependencies are discovered in function code

• When establishing runtime monitoring for serverless workloads to detect injection or credential theft

Do not use for container-based compute security (see securing-kubernetes-on-cloud), for API Gateway configuration (see implementing-cloud-waf-rules), or for serverless architecture design decisions.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• AWS Lambda, Azure Functions, or GCP Cloud Functions with deployment access
• CI/CD pipeline with dependency scanning tools (npm audit, Snyk, Dependabot)
• AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault for secrets management
• CloudWatch, Application Insights, or Cloud Logging for function monitoring

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}