Runbook 01 — Serverless Security Assessment

Runbook Information

Property	Value
Runbook Name	Serverless Security Assessment
Module	Module 07 — Serverless Security
Runbook Number	Runbook 01
Difficulty	Intermediate
Estimated Time	2–4 Hours
Assessment Type	Enterprise Serverless Security Assessment
Cloud Providers	AWS, Microsoft Azure, Google Cloud
Audience	Cloud Security Engineers, Cloud Penetration Testers, Security Consultants, DevSecOps Engineers

Executive Overview

This runbook provides a structured methodology for assessing the security posture of enterprise serverless environments.

It follows the same assessment lifecycle used by enterprise consulting companies when reviewing AWS Lambda, Azure Functions, and Google Cloud Functions deployments.

The objective is to identify security weaknesses, evaluate business impact, prioritize remediation efforts, and provide executive-ready reporting.

Assessment Objectives

The assessment aims to:

Inventory all serverless workloads.
Review cloud identities and permissions.
Assess API security.
Review event-driven architectures.
Assess secrets management.
Validate monitoring and detection.
Evaluate governance and compliance.
Produce enterprise security findings.

Assessment Scope

Review the following services.

Amazon Web Services

AWS Lambda
IAM
API Gateway
EventBridge
CloudWatch
CloudTrail
Secrets Manager

Microsoft Azure

Azure Functions
Microsoft Entra ID
Managed Identities
Azure API Management
Event Grid
Azure Monitor
Azure Key Vault

Google Cloud Platform

Cloud Functions
Google Cloud IAM
Service Accounts
Eventarc
Pub/Sub
Cloud Logging
Secret Manager

Assessment Methodology

Planning

↓

Architecture Review

↓

Function Inventory

↓

Identity Assessment

↓

API Assessment

↓

Event Assessment

↓

Secrets Assessment

↓

Monitoring Assessment

↓

Governance Review

↓

Risk Analysis

↓

Reporting

Phase 1 — Planning

Objectives

Understand the engagement before beginning technical testing.

Review:

Business requirements
Critical applications
Assessment scope
Cloud providers
Production vs Non-production
Compliance requirements

Deliverables

Assessment Scope
Rules of Engagement
Asset List

Phase 2 — Architecture Review

Review:

Serverless architecture
API architecture
Event-driven workflows
Cloud integrations
Identity model
Networking

Assess:

Trust boundaries
Internet exposure
Data flows
High-value assets

Deliverables

Architecture Diagram
Trust Boundary Review

Phase 3 — Serverless Inventory

Create a complete inventory.

Review:

Functions
Regions
Runtime versions
Business owners
Trigger types
Deployment models

Deliverables

Function Inventory
Runtime Inventory

Phase 4 — Identity Assessment

Review:

AWS

IAM Roles
IAM Policies
Resource Policies

Azure

Managed Identities
Azure RBAC
Microsoft Entra ID

Google Cloud

Service Accounts
IAM Roles
Organization Policies

Assess:

Least Privilege
Wildcard permissions
Cross-account access
Administrative permissions
Privilege escalation

Deliverables

Identity Assessment
Privilege Review

Phase 5 — API Assessment

Review:

Authentication
Authorization
JWT validation
OAuth
Rate limiting
API Keys
Web Application Firewall (WAF)

Assess:

Public APIs
Anonymous access
Broken authentication
Weak authorization
Missing validation

Deliverables

API Security Review

Phase 6 — Event Assessment

Review:

AWS

EventBridge
SNS
SQS

Azure

Event Grid
Service Bus

Google Cloud

Eventarc
Pub/Sub

Assess:

Event authorization
Event filtering
Replay protection
Message integrity
Payload validation

Deliverables

Event Security Assessment

Phase 7 — Secrets Management Assessment

Review:

Secrets Manager
Azure Key Vault
Google Secret Manager
Environment variables
KMS integration
Secret rotation

Assess:

Hardcoded credentials
Plain-text secrets
IAM permissions
Secret lifecycle

Deliverables

Secrets Assessment

Phase 8 — Monitoring Assessment

Review:

AWS

CloudTrail
CloudWatch
GuardDuty

Azure

Azure Monitor
Activity Logs
Microsoft Sentinel

Google Cloud

Cloud Logging
Cloud Audit Logs
Security Command Center

Assess:

Log coverage
Alerting
SIEM integration
Threat detection
Identity monitoring

Deliverables

Monitoring Assessment

Phase 9 — Governance Review

Review:

Identity governance
Secure SDLC
Change Management
Logging standards
Secrets governance
Incident Response
Compliance controls

Assess whether governance supports secure serverless operations.

Deliverables

Governance Assessment

Phase 10 — Risk Analysis

Classify findings using enterprise risk ratings.

Severity	Description
Critical	Immediate business risk
High	Significant production risk
Medium	Security weakness requiring remediation
Low	Minor improvement opportunity
Informational	Best practice recommendation

Prioritize findings according to:

Business impact
Likelihood
Exploitability
Compliance impact

Evidence Collection Checklist

Collect evidence for:

Function configurations
IAM policies
Managed Identities
Service Accounts
API Gateway settings
Event configurations
Secrets Manager
Azure Key Vault
Google Secret Manager
Cloud logs
Monitoring dashboards
Security alerts

Store screenshots and exported configurations for the final report.

Executive Deliverables

Produce:

Executive Summary
Architecture Review
Identity Assessment
Function Security Assessment
API Security Assessment
Event Security Assessment
Secrets Management Assessment
Monitoring Assessment
Governance Assessment
Risk Register
Security Scorecard
Prioritized Remediation Roadmap

Common Enterprise Findings

Frequently observed issues include:

Overly permissive IAM roles
Publicly exposed APIs
Hardcoded secrets
Weak Managed Identity permissions
Shared Service Accounts
Missing replay protection
Insecure event sources
Missing CloudTrail or Audit Logs
Weak monitoring coverage
Poor identity governance

Success Criteria

The assessment is complete when you have:

Inventoried all serverless workloads.
Assessed identities and permissions.
Reviewed API and event security.
Evaluated secrets management.
Validated monitoring and detection.
Reviewed governance processes.
Prioritized risks based on business impact.
Produced executive-ready consulting documentation.

Consultant Tips

During enterprise consulting engagements:

Review architecture before reviewing individual functions.
Focus first on identities because they define the serverless security boundary.
Verify every event source that can invoke a production function.
Confirm secrets are retrieved securely from managed secret stores.
Validate centralized logging and SIEM integration.
Support every finding with evidence.
Prioritize remediation based on business risk rather than technical severity alone.

Runbook Summary

This runbook provides the complete methodology for conducting enterprise serverless security assessments across AWS, Microsoft Azure, and Google Cloud.

Following this structured process enables Cloud Penetration Testers and Cloud Security Consultants to consistently identify security weaknesses, evaluate operational maturity, prioritize remediation, and deliver professional consulting reports using the GoHackersCloud Enterprise Serverless Security Assessment Framework.

Next Runbook

➡️ Runbook 02 — Serverless Identity & API Review

In the next runbook, you will perform a deep assessment of serverless identities, IAM roles, Managed Identities, Service Accounts, API Gateways, authorization models, privilege escalation paths, and Zero Trust identity architecture across AWS, Azure, and Google Cloud.