OM-BP-0015: Grant access to Serverless Computing functions via RBAC and apply least privilege (Best Practice)

Rationale

Ephemeral functions may be compromised and become a stepping stone for lateral movement.

Bad Practices

• Grant directly accesses to ephemeral functions

• Do not limit those accesses to the minimum required

Implementation Details

Quotes

The primary mechanisms made available by cloud providers for mitigating these threats are role-based access controls (RBAC), known as Identity and Access Management (IAM) roles in the popular Amazon Lambda service [38]. Using IAM, cloud customers can statically assign each function to a role that is associated with a set of permissions for accessing other functions, datastores, or the open Internet. Accepting the reality that exploitable vulnerabilities will continue to exist in the serverless landscape, strict IAM roles can be configured such that functions are restricted to communicating only with those components necessary to fulfill their task, thus reducing overprivilege. Unfortunately, there is already ample evidence that static RBAC alone is insufficient; not only are IAM roles often misconfigured [4, 19], but even when correctly defined, attackers are able to leverage legitimate function transitions to move laterally through the application in advancement of their goals [10, 64, 71].

Bibliography

• Sankaran et al., 2020

Related Best Practices

N/A