Lab 04 — Serverless Identity & Event Injection Assessment

Mission Information

Property	Value
Lab Name	Serverless Identity & Event Injection Assessment
Module	Module 07 — Serverless Security
Lab Number	Lab 04
Difficulty	Advanced
Estimated Time	2–3 Hours
Cloud Provider	AWS, Microsoft Azure, Google Cloud
Environment	Multi-Cloud Serverless Environment
Prerequisites	Complete Lessons 01–09
Tools Used	AWS CLI, Azure CLI, gcloud CLI, IAM Explorer, CloudTrail, Azure Activity Logs, Cloud Audit Logs, API Gateway, EventBridge, Event Grid, Eventarc

Mission Brief

CloudNova Technologies has been contracted by MedSecure Global to perform an enterprise assessment of identity security and event-driven serverless workflows.

The organization operates a hybrid multi-cloud platform using AWS Lambda, Azure Functions, and Google Cloud Functions connected through APIs, messaging services, cloud events, storage triggers, and automation workflows.

Executive leadership is concerned that attackers may exploit excessive permissions, insecure event sources, or trust relationships to gain unauthorized access to sensitive healthcare applications.

You have been assigned as the Lead Cloud Penetration Tester responsible for identifying identity-related weaknesses, privilege escalation opportunities, and event injection risks before delivering a professional consulting report.

Learning Objectives

By completing this lab you will learn how to:

Assess serverless identities.
Review IAM permissions.
Evaluate Managed Identities.
Assess Service Accounts.
Review API Gateway security.
Assess event injection risks.
Identify privilege escalation opportunities.
Produce an enterprise security assessment.

Enterprise Scenario

During this engagement you will assess:

AWS IAM Roles
Azure Managed Identities
Google Service Accounts
API Gateway
Azure API Management
EventBridge
Event Grid
Eventarc
Amazon SNS
Amazon SQS
Google Pub/Sub
Azure Service Bus

Lab Architecture

Users

↓

API Gateway

↓

Serverless Functions

↓

Execution Identities

├── AWS IAM Roles
├── Azure Managed Identities
├── Google Service Accounts

↓

Cloud Services

↓

Event Sources

├── EventBridge
├── Event Grid
├── Eventarc
├── SNS
├── SQS
├── Pub/Sub

↓

Logging & Monitoring

↓

Security Operations Centre (SOC)

Lab Tasks

Task 01 — Inventory Serverless Identities

Review:

IAM Roles
Managed Identities
Service Accounts
Trust Relationships
Resource ownership

Identify:

High-value identities
Administrative identities
Shared identities

Expected Outcome

Develop a complete inventory of identities used by serverless workloads.

Task 02 — Assess Identity Permissions

Review:

IAM Policies
Azure RBAC
Google IAM Roles
Resource permissions
Wildcard permissions
Administrative roles

Validate:

Principle of Least Privilege
Role separation
Resource restrictions

Expected Outcome

Identify excessive permissions that increase enterprise risk.

Task 03 — Review Trust Relationships

Assess:

AssumeRole policies
Managed Identity assignments
Service Account trust
Cross-account trust
Cross-subscription access
Cross-project permissions

Expected Outcome

Determine whether trust relationships expose privilege escalation opportunities.

Task 04 — Assess API Gateway Security

Review:

Authentication
Authorization
API Keys
OAuth configuration
JWT validation
WAF integration
Rate limiting

Validate:

Secure API access
Input validation
Public endpoint exposure

Expected Outcome

Identify API security weaknesses that could enable unauthorized serverless execution.

Task 05 — Assess Event Injection Risks

Review:

EventBridge rules
Azure Event Grid
Google Eventarc
Pub/Sub
SNS
SQS
Service Bus

Validate:

Event authorization
Payload validation
Event filtering
Replay protection
Trigger permissions

Expected Outcome

Identify opportunities for unauthorized function execution through event manipulation.

Task 06 — Assess Privilege Escalation

Review:

IAM escalation paths
Role chaining
Cross-service permissions
Resource policies
Identity inheritance
Temporary credentials

Identify:

Privilege escalation opportunities
Lateral movement paths
Excessive cloud permissions

Expected Outcome

Determine how attackers could expand access after compromising a serverless identity.

Task 07 — Assess Monitoring & Detection

Review:

CloudTrail
Azure Activity Logs
Cloud Audit Logs
API Gateway logs
Function invocation logs
SIEM integration
Alert generation

Validate:

Identity monitoring
Event monitoring
API monitoring
Threat detection

Expected Outcome

Determine whether the Security Operations Centre can detect identity abuse and event injection attacks.

Task 08 — Review Governance

Assess:

IAM governance
Identity lifecycle
Permission review process
Event governance
API governance
Security standards

Validate:

Periodic access reviews
Separation of duties
Compliance requirements

Expected Outcome

Evaluate the maturity of enterprise identity governance.

Task 09 — Prioritize Security Findings

Classify findings using enterprise risk ratings.

Severity	Description
Critical	Immediate enterprise-wide security risk
High	Significant privilege escalation or unauthorized access risk
Medium	Security weakness requiring planned remediation
Low	Minor improvement opportunity
Informational	Best practice recommendation

Prioritize remediation based on business impact, exploitability, and operational risk.

Task 10 — Produce Executive Assessment Report

Prepare:

Executive Summary
Identity Architecture Review
IAM Assessment
API Security Assessment
Event Injection Assessment
Privilege Escalation Review
Monitoring Assessment
Risk Register
Security Scorecard
Remediation Roadmap

Expected Deliverables

At the conclusion of this lab you should produce:

Serverless Identity Security Assessment Report
Identity Inventory
IAM Permissions Review
API Security Assessment
Event Injection Assessment
Privilege Escalation Analysis
Monitoring Assessment
Risk Register
Executive Summary
Evidence Screenshots

Success Criteria

You have successfully completed this lab when you can:

Assess serverless identities across AWS, Azure, and Google Cloud.
Identify excessive permissions and privilege escalation paths.
Review API security and event-driven architectures.
Assess monitoring and governance controls.
Prioritize findings according to business impact.
Produce professional consulting documentation suitable for enterprise customers.

Real-World Skills Gained

After completing this lab you will be able to perform responsibilities commonly expected of:

Cloud Penetration Tester
Serverless Security Consultant
Cloud IAM Security Engineer
Cloud Security Architect
DevSecOps Security Engineer
Enterprise Security Consultant
Red Team Operator (Cloud)

Lab Summary

In this lab, you performed a comprehensive assessment of serverless identities and event-driven architectures using the GoHackersCloud Enterprise Serverless Security Assessment Framework.

You evaluated IAM roles, Managed Identities, Service Accounts, API security, trust relationships, privilege escalation paths, event injection risks, monitoring capabilities, and governance controls before documenting technical findings and business risks in an executive-ready consulting report.

Next Lab

➡️ Lab 05 — Enterprise Serverless Security Assessment

In the next lab, you will perform a complete end-to-end enterprise serverless security assessment across AWS Lambda, Azure Functions, Google Cloud Functions, identities, APIs, event sources, secrets management, monitoring, governance, and operational maturity using the GoHackersCloud Enterprise Serverless Security Assessment Framework.