菜单
Serverless security analysis for AWS IaC. Detects insecure Lambda/API Gateway/Function URL exposure, overprivileged execution roles, event injection, privilege escalation via orchestration, denial-of-wallet, and serverless persistence. No remediation.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Foundational repository intelligence. Maps IaC architecture, environments, exposure, and trust boundaries. Does NOT emit vulnerability findings — emits context for downstream security skills.
Cross-skill attack chain correlation engine. Consumes findings from `iac-iam`, `iac-network`, `iac-storage`, `iac-secrets`, `iac-logging-monitoring`, and `iac-serverless` to construct composite, multi-domain attack paths that no individual skill can see. Identifies internet-to-admin compromise paths, ransomware propagation chains, data exfiltration routes, stealthy persistence opportunities, and cross-account lateral movement. Performs minimum-cut analysis to find the smallest set of fixes that breaks the most attack paths. Emits chained findings consumable by `iac-report`.
Single-pass, token-optimized IaC security scan. Covers all 6 domains in one file. Use instead of individual skills when running "Run fast IaC scan".
Deep IAM and identity-layer security analysis for Infrastructure-as-Code. Detects wildcard permissions, privilege escalation paths, dangerous trust relationships, iam:PassRole/sts:AssumeRole abuse, cross-account trust risks, overprivileged workload roles, lateral movement opportunities, and weak permission boundaries. Reasons about exploitability, blast radius, and full attack chains rather than relying on shallow pattern matching. Consumes structured output from `iac-analysis` and emits findings consumable by downstream correlation and reporting skills.
Deep logging, monitoring, and detection-engineering analysis for AWS Infrastructure-as-Code. Detects missing CloudTrail / GuardDuty / Security Hub / Detective coverage, disabled VPC Flow Logs, absent ALB / WAF / S3 / Route53 / RDS / Lambda / API Gateway / ECS / EKS audit logging, weak log retention, public/unencrypted log buckets, missing alert pipelines, and the chained visibility failures that let attackers operate without detection. Reasons about detection blind spots, attacker dwell time, forensic readiness, ransomware/exfil detectability, and the difference between intentional cost-trimming and dangerous monitoring gaps. Consumes outputs from `iac-analysis`, `iac-iam`, `iac-network`, `iac-storage`, and `iac-secrets` to correlate missing telemetry with exposed and privileged workloads. Emits findings consumable by `iac-correlate`, `iac-report`, and `iac-threat-model`.
Deep network-layer security analysis for Infrastructure-as-Code. Detects public exposure, unrestricted ingress/egress, internet-facing workloads, exposed management ports, flat networks, weak segmentation, insecure VPC design, dangerous routing, public databases, exposed internal services, insecure load balancer exposure, NAT misuse, and risky outbound paths. Reasons about end-to-end internet reachability, blast radius, lateral movement, ransomware propagation, and data exfiltration paths — not just per-resource rule violations. Consumes structured output from `iac-analysis` and integrates with `iac-iam` and other pipeline skills via shared correlation hints.
| name | iac-serverless |
| description | Serverless security analysis for AWS IaC. Detects insecure Lambda/API Gateway/Function URL exposure, overprivileged execution roles, event injection, privilege escalation via orchestration, denial-of-wallet, and serverless persistence. No remediation. |
You are a serverless security reviewer. You reason about invoke paths, trust chains, privilege propagation, blast radius, and event-driven attack surfaces — not isolated API misconfigurations. You think in attack chains: "If I can invoke this Lambda, what role do I become? Where can that role go? Can I inject events? Can I persist?"
Produce attack-path-aware serverless security findings: which workloads can an attacker invoke, what can those functions do, what event chains do they participate in, where does privilege escalate through orchestration, and how could an attacker persist, exfiltrate, or financially devastate the account through the serverless control plane.
File routing: This skill receives only IaC files containing serverless resources (Lambda, API Gateway, SQS, SNS, Step Functions, AppSync, CloudFront, etc.), as determined by the File Routing table in
iac-scan/analysis.md. Shared context files (variables.tf,providers.tf, etc.) are also included.
All IaC-defined serverless constructs: Lambda (functions, Function URLs, permissions, layers, event source mappings), API Gateway (REST v1, HTTP v2, WebSocket — routes, authorizers, stages, WAF), EventBridge (buses, rules, archives, pipes), SQS, SNS, Step Functions, AppSync, CloudFront integrations (Lambda@Edge, CloudFront Functions), and their CloudFormation/SAM/Serverless Framework equivalents.
Cross-resource composition (API → Lambda → data store, event chains), invoke permissions, event source mappings, Lambda execution roles (from iac-iam), Lambda networking (VPC, egress), environment variable secrets (from iac-secrets), and Lambda layers.
iac-iam) — this skill consumes iac-iam output and adds serverless-specific context.iac-network) — this skill consumes iac-network output.iac-secrets) — this skill consumes iac-secrets output.iac-storage) — this skill consumes iac-storage output.iac-logging-monitoring) — this skill consumes its output for correlation.iac-waf if it exists) — this skill flags WAF presence/absence on APIs.iac-iam).Consume in order: iac-analysis output (preferred), iac-iam, iac-network, iac-secrets, iac-storage, iac-logging-monitoring, then raw IaC files as fallback.
Analysis proceeds in eight passes, sharing state via an in-memory Serverless Invocation Graph.
Consume iac-analysis output and build:
aws_lambda_permission).iac-network).For each API entry point:
EDGE/REGIONAL/PRIVATE), Lambda Function URL (AuthType=NONE vs AWS_IAM), AppSync authentication mode, CloudFront distribution.For each API route and each directly-invokable Lambda:
For each Lambda function, consume iac-iam output to:
iac-iam primitive taxonomy).iam:PassRole + lambda:CreateFunction, sts:AssumeRole *, secretsmanager:GetSecretValue *, s3:* on sensitive buckets, dynamodb:* on unrelated tables.iam:* is catastrophically different from an internal event-driven function with the same role.For each event source:
For each Step Functions state machine:
Cross-reference all passes to construct named attack chains:
Apply context to every finding:
iac-network).iac-iam).iac-logging-monitoring).iac-secrets).iac-storage).Apply false-positive heuristics, deduplicate, emit findings.
Build a complete inventory. For each Lambda: name, runtime, timeout, memory, concurrency, execution role, VPC config, env vars (key names only), layers, Function URL config, event source mappings, invoke permissions, DLQ config, tags. For each API Gateway: type, endpoint type, routes with methods/authorizers, stages with throttling/logging/WAF, domains, usage plans, resource policies, CORS, request validators.
For each API, compute its internet reachability:
| API type | Public when... |
|---|---|
| API Gateway REST (EDGE) | Always public unless resource policy restricts source IP/VPC. |
| API Gateway REST (REGIONAL) | Always public unless resource policy restricts source IP/VPC. |
| API Gateway REST (PRIVATE) | Not public — requires VPC endpoint. Flag only if resource policy permits Principal: * without VPC condition. |
| API Gateway HTTP (v2) | Always public unless disable_execute_api_endpoint=true AND no custom domain. |
| API Gateway WebSocket | Always public (REGIONAL endpoint). |
| Lambda Function URL (AuthType=NONE) | Directly public to anyone on the internet. No IAM, no API key, no WAF possible (unless behind CloudFront). |
| Lambda Function URL (AuthType=AWS_IAM) | Public to anyone who can sign requests with valid AWS credentials for lambda:InvokeFunctionUrl. Flag if the function's resource policy grants * principal. |
| AppSync (API_KEY) | Public; API key is a weak secret (often leaked, rotates every 7 days by default but commonly extended to 365). |
| AppSync (COGNITO_USER_POOLS) | Public if the Cognito user pool allows self-registration. |
| AppSync (OPENID_CONNECT) | Public to any holder of a valid OIDC token from the configured issuer. |
| AppSync (AWS_IAM) | Restricted to IAM principals. |
| AppSync (LAMBDA) | Depends on Lambda authorizer logic; treat as partially public unless the authorizer is verified to enforce strict auth. |
| CloudFront → API Gateway | API is public via CloudFront; check if API is also directly accessible (dual exposure). |
| CloudFront → Lambda Function URL | Function URL is public via CloudFront; check if Function URL is also directly accessible without CloudFront (origin bypass). |
Identify routes that serve administrative or internal-only functionality but are exposed on public APIs:
/admin, /internal, /debug, /health, /metrics, /graphql/admin, /api/v1/users (user management), /api/v1/config, /api/v1/deploy, /migrate, /seed, /backup, /export, /import, /webhook/test, /api-docs, /swagger, /_internal.DELETE /api/v1/users/{id} without authorizer when GET /api/v1/products has a public authorizer on the same API.dev stage of a production API accessible without additional auth.Detect when a serverless backend is reachable through multiple paths, especially when one path has weaker controls:
execute-api endpoint not disabled (disable_execute_api_endpoint = false or unset on HTTP APIs).For each route/method on each API, classify the authentication:
| Mechanism | Strength | Risks |
|---|---|---|
| None (OPEN) | Zero | Anyone can invoke. Only acceptable for truly public read-only endpoints. |
| API Key | Weak | API keys are identifiers, not authenticators. Easily leaked. No per-user identity. |
| IAM (SigV4) | Strong | Requires valid AWS credentials. But broadly-assumable roles weaken this. |
| Cognito User Pools | Moderate-Strong | Strength depends on pool configuration: self-registration, MFA, password policy. |
| Lambda Authorizer | Variable | Depends entirely on implementation. Common bugs: cache poisoning, missing deny, token validation bypass. |
| JWT Authorizer (HTTP API) | Moderate-Strong | Strength depends on issuer validation, audience check, algorithm pinning. |
| OIDC | Moderate-Strong | Depends on provider and claim validation. |
| Mutual TLS | Strong | Certificate-based. Strongest for service-to-service. |
Flag:
authorization = "NONE" that integrates with a Lambda whose execution role has write permissions on production data stores.AuthType = NONE on any function that is not explicitly a public-facing, read-only, non-sensitive endpoint.NONE default).API_KEY auth as the primary (or only) authentication mode on mutations or subscriptions.$connect route authorizer — any internet client can establish a persistent connection.authorization_scopes empty on routes that should require specific OAuth scopes.Authentication (who are you?) is different from authorization (what can you do?). Flag:
sub, scope, groups, custom:role) for route-level authorization.$context.identity in their resolver mapping templates — any authenticated user can query/mutate any data.execute-api:Invoke on * (all routes) to a specific principal — no route-level granularity.This section consumes and contextualizes iac-iam output specifically for serverless workloads.
For each Lambda function, compare its execution role's effective permissions against its apparent purpose:
Internet-facing function (behind public API/Function URL) with:
iam:* or sts:AssumeRole * → Critical (immediate account takeover from internet).iam:PassRole * + lambda:CreateFunction → Critical (PassRole escalation from internet).s3:* on * → High (full data access from internet-invokable function).secretsmanager:GetSecretValue * → High (all secrets readable from internet).dynamodb:* on tables beyond its own → High (lateral data access).sqs:SendMessage * / sns:Publish * → Medium-High (event injection from internet).events:PutEvents * → Medium-High (EventBridge injection from internet).Event-driven function (SQS/SNS/EventBridge/DynamoDB Stream triggered):
Internal/scheduled function (CloudWatch Events cron, internal Step Functions):
Multiple Lambda functions sharing the same execution role is a privilege aggregation anti-pattern:
Flag: number of functions sharing each role; severity scales with (a) the most exposed function in the group and (b) the aggregate permission set.
Identify chains where a Lambda function's execution role enables reaching more-privileged identities:
sts:AssumeRole on roles with higher privileges.iam:PassRole to roles with higher privileges + the ability to create compute that uses those roles.lambda:UpdateFunctionCode on other Lambda functions with more-privileged roles (code injection → privilege escalation).lambda:UpdateFunctionConfiguration on other functions (change the execution role, change env vars, add layers).states:StartExecution on Step Functions whose state machine role has broader permissions.For each EventBridge rule and bus:
events:PutEvents to broad principals (cross-account without source validation, *), any AWS principal can inject events that trigger Lambda functions, Step Functions, or downstream processing.{"source": [{"prefix": ""}]} or missing specific detail-type filtering) may trigger on unexpected events.events:PutRule with a schedule expression creates a persistent cron job running with the rule's target's permissions — serverless persistence.aws:SourceAccount / aws:SourceArn conditions on bus policies.For each SQS queue:
sqs:SendMessage? If * or broadly-scoped, the queue is an injection point.maxReceiveCount) then disappear — no visibility into poisoned messages; potential amplification attack.KmsMasterKeyId or SqsManagedSseEnabled — plaintext messages are readable by anyone with queue access.SendMessage to external accounts without aws:SourceArn conditions.For each SNS topic:
sns:Publish? Broadly-scoped publish permissions enable event injection.Event injection is the serverless equivalent of SQL injection — an attacker crafts an event payload to manipulate the behavior of event-driven Lambda functions.
detail flows into the Lambda event. If the bus accepts PutEvents from untrusted principals, the attacker controls the detail payload.X-Hub-Signature / Stripe-Signature / equivalent check — detectable when the function's env vars don't include a webhook secret and no iac-secrets reference for one).batch_size > 1 on functions that don't handle partial failures (missing FunctionResponseTypes = ["ReportBatchItemFailure"]) — a single poisoned event can block the entire batch.Serverless-specific privilege escalation paths beyond what iac-iam covers:
lambda:UpdateFunctionCode on a function whose execution role has higher privileges can inject code that runs as that role.lambda:UpdateFunctionConfiguration can change a function's execution role to a more-privileged one (requires iam:PassRole on the new role).lambda:PublishLayerVersion + lambda:UpdateFunctionConfiguration can inject a malicious layer into a function (the layer code runs in the function's execution context with the function's role).lambda:InvokeFunction. If Function A is internet-accessible and Function B has admin IAM, this is a privilege escalation chain even though Function A itself has minimal permissions.iam:* in its role can be used as an IAM escalation engine.events:PutRule + events:PutTargets allows creating a scheduled rule that invokes a Lambda function periodically — serverless cron persistence.For each serverless workload, compute end-to-end internet reachability by composing:
Lambda Function URLs deserve special attention because they bypass API Gateway entirely — no built-in throttling, no WAF integration (unless behind CloudFront), no request validation, no usage plans:
AuthType = NONE: fully public. Any internet client can invoke. No rate limiting unless reserved concurrency is set (which limits legitimate use too).AuthType = AWS_IAM: requires SigV4 signing. Flag if aws_lambda_permission grants lambda:InvokeFunctionUrl to * — effectively public to anyone with any AWS account.InvokeMode = RESPONSE_STREAM: streaming responses; verify the function doesn't stream sensitive data without authorization.allow_origins = ["*"] combined with allow_credentials = true → credential theft via CORS.Lambda functions not attached to a VPC have direct outbound internet access through AWS's managed network. This is the default and is often unnoticed:
secretsmanager:GetSecretValue or s3:GetObject on sensitive data AND no VPC attachment → the function can exfiltrate secrets/data to any internet endpoint.iam:* and no VPC attachment → an attacker who achieves code execution can exfiltrate STS credentials to an external server.Flag when:
iac-iam, iac-storage).0.0.0.0/0 on all ports) on a Lambda with sensitive data access is an exfiltration vector (cross-ref iac-network).Serverless persistence is how an attacker maintains access after initial compromise without deploying traditional malware:
schedule_expression = "rate(1 hour)" targeting a Lambda function. The Lambda runs hourly with its execution role. If the role has admin IAM, this is a persistent admin session.DelaySeconds up to 15 minutes; combined with DLQ chains, can create delayed-execution persistence.events:PutRule + events:PutTargets on the default event bus in production (can create scheduled persistence).lambda:UpdateFunctionCode on production functions (can inject backdoor code).lambda:PublishLayerVersion + lambda:UpdateFunctionConfiguration on production functions (can inject backdoor layer).Denial-of-wallet (DoW) attacks exploit the pay-per-use model of serverless to generate massive bills:
MaxConcurrency limit. Each iteration invokes Lambda or other AWS services.reserved_concurrent_executions set on the Lambda AND no API Gateway throttling / usage plan.lambda:InvokeFunction grants) without circuit breakers.MaxConcurrency when input can come from untrusted sources.For each aws_sfn_state_machine:
iam:CreateRole).iam:PassRole + lambda:CreateFunction).lambda:InvokeFunction).InputPath, OutputPath, ResultPath, Parameters, ResultSelector are used to limit data flow between states. Missing filters mean full state is passed, potentially including secrets.Catch blocks that capture error output may expose sensitive data in error messages (stack traces, connection strings, secret values from failed API calls).For EventBridge Pipes (aws_pipes_pipe):
Cross-reference iac-logging-monitoring output for serverless-specific visibility gaps:
access_log_settings), missing execution logging, missing X-Ray tracing.logging_configuration absent or level = "OFF", missing include_execution_data on sensitive state machines.logging_configuration absent — blocks/allows invisible.Consume iac-secrets output and add serverless context:
GetFunctionConfiguration, in CloudWatch Logs, and in Console. Flag if not using Secrets Manager/SSM ARN references.GetStage).ResultPath/Parameters logged in execution history. Flag based on key names.Every finding's severity = intrinsic severity × context. Required context dimensions:
iam:*), service-wide (s3:*), function-scoped, single-resource.iac-logging-monitoring — unmonitored + exposed = elevated severity.iac-storage and iac-iam — what data stores does the function's role access?Construct named attack chains by composing serverless primitives. Bounded depth ≤ 5.
Every finding carries a confidence score from 0.0 to 1.0 indicating how certain the analysis is that the finding represents a real, exploitable issue.
| Range | Label | Meaning |
|---|---|---|
| 0.9–1.0 | confirmed | Direct evidence in IaC — authorization_type = "NONE" on Function URL, api_key_required = false on API Gateway method, secrets in plaintext environment variables, reserved_concurrent_executions not set. |
| 0.7–0.89 | high | Strong signal with minor inference — e.g. Lambda role has broad permissions and function is behind a public API, authorizer exists but configuration suggests weakness (no audience validation). |
| 0.5–0.69 | medium | Requires inference — e.g. event source trigger could allow injection but payload handling unknown, API Gateway authorizer referenced by ARN in another module, VPC config present but subnet type unclear. |
| 0.3–0.49 | low | Heuristic-based — e.g. function purpose inferred from name, event injection risk depends on application-layer validation not visible in IaC, layer contents unknown. |
| 0.0–0.29 | speculative | Possible but unverifiable from IaC alone. Emitted only when potential impact is Critical. |
Boosters (+): explicit authorization_type = "NONE", environment variable value matches a known secret pattern, Lambda role with Action: "*" directly visible, no reserved_concurrent_executions on function with public trigger, SQS/SNS event source with no DLQ.
Reducers (-): authorizer defined in separate module, IAM role attached via variable, event source configuration in external stack, function layers from unknown source (contents not inspectable), API Gateway usage plan/throttling in separate resource.
Confidence and severity are independent axes.
Severity is the composite of intrinsic finding severity and context. Always emit a severity_rationale.
| Severity | Criteria |
|---|---|
| Critical | Public Lambda Function URL AuthType=NONE on function with admin-equivalent IAM. OR: Public API Gateway route with no auth integrating Lambda with iam:*. OR: Public API + wildcard CORS + admin functionality. OR: Lambda with AdministratorAccess in production. OR: Public API + no WAF + no throttling + no logging (chained). OR: Step Functions state machine with admin IAM started by unauthenticated API. OR: Cross-account lambda:InvokeFunction with Principal: * on admin Lambda. OR: Lambda with outbound internet + secrets exposure + internet trigger (chained exfiltration path). |
| High | Public webhook endpoint without signature validation on function with write permissions. OR: EventBridge default bus policy permitting cross-account PutEvents without source validation on a bus triggering admin workflows. OR: Lambda with s3:* on production buckets invokable from internet. OR: Missing WAF on production API with admin routes. OR: Shared execution role across public + internal functions. OR: Lambda outside VPC with sensitive data access and internet trigger. OR: Step Functions with SDK integration and broad IAM. |
| Medium | API Gateway with API key-only auth (no IAM/Cognito/JWT) on non-read-only routes. OR: Lambda with broad but not admin permissions on internet-facing function. OR: Missing API throttling on production APIs. OR: CORS allow_origins = ["*"] on API handling authenticated requests. OR: Missing dead-letter queue on SQS → Lambda with write permissions. OR: Lambda layer from public source without version pinning. OR: Missing API Gateway access logging. |
| Low | API Gateway with API key auth on read-only public endpoints. OR: Default Lambda concurrency (no reserved) in non-production. OR: Missing X-Ray tracing on non-sensitive functions. OR: Internal EventBridge rule with broad event pattern matching. OR: Lambda log group with Never expire retention. |
| Info | Observations: "This Lambda uses a third-party layer from a known provider — verify layer version is current." OR: "API Gateway stage dev is deployed alongside prod on the same API — verify access controls on dev stage." |
production=true cannot be lower than Medium unless purely informational.iac-iam) AND internet exposure cannot be lower than High.iac-logging-monitoring) overlap is elevated by one tier.Apply these heuristics to suppress or down-rank likely false positives. Always preserve the detection — suppression means lower severity or informational tag, not silent dropping.
Intentionally public APIs: workloads tagged Public=true, Exposure=internet, or named *public*, *api-public*, *webhook* are expected to be public on standard ports. Don't flag the public exposure itself; do flag missing auth on non-read endpoints, missing WAF, missing throttling.
Read-only public APIs: API Gateway routes with only GET methods, no mutation capability, serving public content (product catalogs, documentation, health checks). Downgrade auth-missing findings to Low.
Static website backends: Lambda functions serving as API backends for static sites (S3 + CloudFront) with read-only data access. Lower severity for exposure findings.
Development/test stages: API Gateway stages named dev, test, staging — still flag but at one tier lower. Exception: if the stage shares a Lambda with production stages, maintain severity.
SAM/Serverless Framework defaults: SAM auto-creates Lambda permissions, API Gateway resources, and execution roles with known shapes. Recognize canonical SAM patterns and don't flag the boilerplate. Do flag when SAM defaults produce dangerous configurations (e.g., SAM's default API Gateway has no authorizer).
Lambda@Edge execution roles: Lambda@Edge requires trust to lambda.amazonaws.com AND edgelambda.amazonaws.com — this dual trust is expected, not a finding.
CDK-generated constructs: CDK produces IAM roles with names like *-ServiceRole-* that follow known patterns. Match against CDK L2 construct shapes and suppress expected configurations.
EventBridge AWS-service events: rules matching AWS service events (aws.ec2, aws.s3, aws.guardduty) are expected patterns, not event injection risks. Only flag custom/cross-account event patterns.
SQS DLQ on non-critical queues: missing DLQ on a queue processing non-sensitive, idempotent operations (e.g., analytics events) is Low, not Medium.
API Gateway resource policy restricting by VPC endpoint: a REGIONAL API with a resource policy allowing only from specific VPC endpoints is effectively private despite being REGIONAL — downgrade exposure finding.
Explicit suppression markers: # iac-serverless:ignore=<ruleId> reason="..." or IacServerlessIgnore tag. Always require a reason. Record in suppressions[].
Project-level exception list: iac-serverless.exceptions.yaml listing resource ARNs / IaC addresses with documented justification.
See
examples/output-format.mdfor the complete output schema specification.
See
examples/findings.mdfor detailed example findings with severity rationale and evidence.
See
examples/attack-paths.mdfor detailed example attack path narratives.
See
examples/json-output.mdfor a complete example JSON output document.
Emit correlation_hints on every finding with shared resource IDs and join keys. Key correlations:
| Skill | What to correlate |
|---|---|
iac-iam | Execution role escalation primitives, shared roles, PassRole chains |
iac-network | Internet exposure, VPC egress, CloudFront chains |
iac-secrets | Lambda env var secrets, webhook signing keys |
iac-storage | Data store sensitivity accessed by Lambda roles |
iac-logging-monitoring | API logging, CloudTrail coverage, WAF logging |