Lab 01 — AWS Lambda Security Assessment
Mission Information
Section titled “Mission Information”| Property | Value |
|---|---|
| Lab Name | AWS Lambda Security Assessment |
| Module | Module 07 — Serverless Security |
| Lab Number | Lab 01 |
| Difficulty | Intermediate |
| Estimated Time | 90–120 Minutes |
| Cloud Provider | Amazon Web Services (AWS) |
| Environment | AWS Lambda |
| Prerequisites | Complete Lessons 01–09 |
| Tools Used | AWS Console, AWS CLI, IAM, CloudTrail, CloudWatch, AWS Lambda, API Gateway, AWS Secrets Manager |
Mission Brief
Section titled “Mission Brief”CloudNova Technologies has been contracted by MedSecure Global to perform an enterprise security assessment of its AWS Lambda environment.
The organization operates hundreds of Lambda functions supporting healthcare APIs, billing systems, patient management applications, automation workflows, and AI-powered services.
Executive leadership wants assurance that Lambda functions follow enterprise security best practices, implement least privilege, securely manage secrets, and provide sufficient monitoring for the Security Operations Centre (SOC).
You have been assigned as the Lead Cloud Penetration Tester responsible for assessing AWS Lambda security and producing a professional consulting report.
Learning Objectives
Section titled “Learning Objectives”By completing this lab you will learn how to:
- Assess AWS Lambda security.
- Review execution roles.
- Evaluate IAM permissions.
- Assess event sources.
- Review environment variables.
- Validate networking configuration.
- Evaluate monitoring and logging.
- Produce an enterprise security assessment.
Enterprise Scenario
Section titled “Enterprise Scenario”During this engagement you will assess:
- AWS Lambda Functions
- IAM Execution Roles
- API Gateway
- EventBridge
- Amazon S3 Events
- Amazon SNS
- Amazon SQS
- AWS Secrets Manager
- CloudWatch
- CloudTrail
Lab Architecture
Section titled “Lab Architecture”Users
↓
Amazon API Gateway
↓
AWS Lambda
↓
IAM Execution Role
↓
AWS Services
├── Amazon S3├── DynamoDB├── SNS├── SQS├── EventBridge├── Secrets Manager
↓
CloudWatch
↓
CloudTrail
↓
Security Operations Centre (SOC)Lab Tasks
Section titled “Lab Tasks”Task 01 — Inventory Lambda Functions
Section titled “Task 01 — Inventory Lambda Functions”Review:
- Function names
- Runtime versions
- Deployment regions
- Function owners
- Business purpose
Expected Outcome
Create a complete inventory of Lambda functions deployed within the AWS account.
Task 02 — Assess IAM Execution Roles
Section titled “Task 02 — Assess IAM Execution Roles”Review:
- IAM Roles
- Attached Policies
- Inline Policies
- Resource Permissions
- Trust Policies
Identify:
- Administrator access
- Wildcard permissions
- Excessive privileges
- Cross-account access
Expected Outcome
Validate that execution roles implement the Principle of Least Privilege.
Task 03 — Review Environment Variables
Section titled “Task 03 — Review Environment Variables”Assess:
- Environment variables
- API Keys
- Tokens
- Database credentials
- Encryption configuration
Verify:
- AWS KMS encryption
- Secure configuration
- Secret exposure
Expected Outcome
Identify insecure handling of sensitive configuration data.
Task 04 — Assess Event Sources
Section titled “Task 04 — Assess Event Sources”Review:
- API Gateway
- EventBridge
- Amazon S3
- Amazon SNS
- Amazon SQS
- Scheduled Events
Validate:
- Event authorization
- Trigger permissions
- Resource policies
- Input validation
Expected Outcome
Determine whether only trusted services can invoke production functions.
Task 05 — Assess Networking
Section titled “Task 05 — Assess Networking”Review:
- VPC configuration
- Private subnets
- Security Groups
- Internet access
- NAT Gateway usage
Validate:
- Network isolation
- Secure connectivity
- Private resource access
Expected Outcome
Ensure Lambda networking follows enterprise security standards.
Task 06 — Review Secrets Management
Section titled “Task 06 — Review Secrets Management”Assess:
- AWS Secrets Manager
- Parameter Store
- Environment variables
- IAM permissions
- Secret rotation
- KMS encryption
Expected Outcome
Verify secure storage and retrieval of sensitive credentials.
Task 07 — Assess Monitoring & Logging
Section titled “Task 07 — Assess Monitoring & Logging”Review:
- Amazon CloudWatch Logs
- AWS CloudTrail
- AWS X-Ray
- AWS Security Hub
- Amazon GuardDuty
Validate:
- Log retention
- Alerting
- SIEM integration
- Security telemetry
Expected Outcome
Determine whether security teams have sufficient visibility into Lambda activity.
Task 08 — Review Runtime Security
Section titled “Task 08 — Review Runtime Security”Assess:
- Supported runtime versions
- Function timeout
- Memory allocation
- Dependency versions
- Third-party libraries
- Runtime updates
Expected Outcome
Identify operational and security risks associated with runtime configuration.
Task 09 — Prioritize Security Findings
Section titled “Task 09 — Prioritize Security Findings”Classify findings as:
- Critical
- High
- Medium
- Low
- Informational
Prioritize remediation according to business impact and exploitability.
Task 10 — Produce Executive Assessment Report
Section titled “Task 10 — Produce Executive Assessment Report”Prepare:
- Executive Summary
- Lambda Architecture Review
- IAM Assessment
- Event Source Review
- Secrets Assessment
- Monitoring Assessment
- Risk Register
- Security Scorecard
- Remediation Roadmap
Expected Deliverables
Section titled “Expected Deliverables”At the conclusion of this lab you should produce:
- AWS Lambda Security Assessment Report
- Lambda Function Inventory
- IAM Permissions Review
- Event Source Assessment
- Secrets Management Review
- Monitoring Assessment
- Risk Register
- Executive Summary
- Evidence Screenshots
Success Criteria
Section titled “Success Criteria”You have successfully completed this lab when you can:
- Assess AWS Lambda security using an enterprise methodology.
- Review IAM execution roles and permissions.
- Evaluate event source security.
- Assess networking and runtime configuration.
- Validate monitoring and logging controls.
- Prioritize findings based on business impact.
- Produce professional consulting documentation.
Real-World Skills Gained
Section titled “Real-World Skills Gained”After completing this lab you will be able to perform responsibilities commonly expected of:
- Cloud Penetration Tester
- AWS Security Consultant
- Serverless Security Engineer
- Cloud Security Engineer
- DevSecOps Security Engineer
- Enterprise Security Consultant
Lab Summary
Section titled “Lab Summary”In this lab, you performed a comprehensive enterprise security assessment of AWS Lambda using the GoHackersCloud Enterprise Serverless Security Assessment Framework.
You reviewed execution roles, IAM permissions, event sources, networking, environment variables, secrets management, runtime configuration, monitoring, and logging before documenting technical findings and business risks in a professional consulting report.
Next Lab
Section titled “Next Lab”➡️ Lab 02 — Azure Functions Security Assessment
In the next lab, you will assess Microsoft Azure Functions by reviewing Managed Identities, Microsoft Entra ID integration, Azure Storage security, networking, authentication, Azure Key Vault, monitoring, and governance using the GoHackersCloud Enterprise Serverless Security Assessment Framework.