Serverless Security: Attack Surface Analysis for AWS Lambda, Azure Functions

The Serverless Attack Surface

Serverless computing shifts infrastructure management to cloud providers but introduces unique security challenges. Functions-as-a-Service (FaaS) like AWS Lambda, Azure Functions, and Google Cloud Functions have distinct attack vectors that traditional security tools miss.

Serverless-Specific Vulnerabilities

Event Injection

Serverless functions are triggered by events from various sources. Each event source is a potential injection point:

# Lambda triggered by API Gateway
def handler(event, context):
    name = event['queryStringParameters']['name']
    # If used in SQL/command without sanitization = injection
    query = f"SELECT * FROM users WHERE name = '{name}'"

Event sources include: API Gateway, S3, SQS, SNS, DynamoDB Streams, CloudWatch Events, Alexa Skills, IoT rules.

Over-Privileged Functions

The biggest serverless security problem. Functions often receive wildcard permissions:

# Too permissive
iamRoleStatements:
  - Effect: Allow
    Action: "*"
    Resource: "*"

Best Practice: One IAM role per function with minimum permissions:

iamRoleStatements:
  - Effect: Allow
    Action:
      - dynamodb:GetItem
      - dynamodb:PutItem
    Resource: "arn:aws:dynamodb:*:*:table/specific-table"

Dependency Vulnerabilities

Serverless functions bundle dependencies that may contain vulnerabilities. The deployment package is the attack surface.

Cold Start Timing Attacks

Information leakage through execution timing differences between cold starts (new container) and warm starts (reused container).

Ephemeral Storage Risks

The /tmp directory persists between warm invocations, potentially leaking data between tenants in multi-tenant functions.

Prevention Strategies

• Apply least privilege IAM per function
• Validate all event input data
• Scan dependencies before deployment
• Use environment variables (encrypted) for secrets
• Set appropriate timeouts and memory limits
• Enable X-Ray tracing for visibility
• Clean /tmp at function start

Where SuperClue Fits

SuperClue does not read serverless function configurations, IAM policies, or event source mappings. Its DAST scanner tests the HTTP endpoints your functions expose, such as API Gateway routes.