Runbook 02 — Serverless Identity & API Review

Runbook Information

Property	Value
Runbook Name	Serverless Identity & API Review
Module	Module 07 — Serverless Security
Runbook Number	Runbook 02
Difficulty	Advanced
Estimated Time	2–4 Hours
Assessment Type	Identity & API Security Assessment
Cloud Providers	AWS, Microsoft Azure, Google Cloud
Audience	Cloud Security Engineers, Cloud Penetration Testers, Security Consultants, DevSecOps Engineers

Executive Overview

Identity is the primary security boundary in modern serverless environments.

Unlike traditional infrastructure, serverless applications rely heavily on cloud identities, API authentication, authorization, trust relationships, and temporary credentials to securely access resources.

This runbook provides a structured methodology for reviewing identity security and API protection across AWS Lambda, Azure Functions, and Google Cloud Functions.

The objective is to identify excessive permissions, privilege escalation paths, weak API controls, identity governance issues, and Zero Trust implementation gaps before attackers can exploit them.

Assessment Objectives

The assessment aims to:

Inventory all serverless identities.
Review IAM permissions.
Assess Managed Identities.
Review Service Accounts.
Evaluate API authentication.
Assess authorization models.
Identify privilege escalation paths.
Validate Zero Trust controls.
Produce executive-ready findings.

Assessment Scope

Amazon Web Services

IAM Roles
IAM Policies
API Gateway
Cognito
STS
Resource Policies

Microsoft Azure

Microsoft Entra ID
Managed Identities
Azure RBAC
Azure API Management
Conditional Access

Google Cloud Platform

Service Accounts
IAM
API Gateway
Identity-Aware Proxy (IAP)
Workload Identity

Assessment Methodology

Planning

↓

Identity Inventory

↓

IAM Review

↓

Authentication Assessment

↓

Authorization Assessment

↓

API Security Review

↓

Privilege Escalation Review

↓

Zero Trust Assessment

↓

Risk Analysis

↓

Executive Reporting

Phase 1 — Identity Inventory

Review every identity used by serverless workloads.

Assess:

IAM Roles
Managed Identities
Service Accounts
Human identities
Machine identities
Temporary identities

Identify:

Shared accounts
Administrative identities
Dormant identities
Third-party identities

Deliverables

Identity Inventory
Identity Ownership Matrix

Phase 2 — IAM Assessment

Review:

AWS

IAM Roles
IAM Policies
Trust Policies
Resource Policies

Azure

Azure RBAC
Management Groups
Subscriptions
Role Assignments

Google Cloud

IAM Roles
IAM Bindings
Organization Policies

Assess:

Least Privilege
Wildcard permissions
Administrative access
Cross-account permissions
Cross-project access

Deliverables

IAM Assessment Report

Phase 3 — Authentication Assessment

Review authentication mechanisms protecting serverless workloads.

Assess:

OAuth
OpenID Connect (OIDC)
JWT Tokens
Microsoft Entra ID
Amazon Cognito
Google Identity
Multi-Factor Authentication (MFA)

Validate:

Token validation
Session security
Identity federation
Authentication strength

Deliverables

Authentication Review

Phase 4 — Authorization Assessment

Review authorization controls.

Assess:

Role-Based Access Control (RBAC)
Attribute-Based Access Control (ABAC)
Resource Policies
API permissions
Service permissions

Identify:

Excessive permissions
Missing authorization
Resource overexposure
Broken access controls

Deliverables

Authorization Assessment

Phase 5 — API Security Review

Review all APIs exposed by serverless applications.

Assess:

API Gateway
Azure API Management
Google API Gateway
Authentication
Authorization
JWT validation
Input validation
Rate limiting
WAF integration

Review:

Public APIs
Internal APIs
Partner APIs
Administrative APIs

Deliverables

API Security Assessment

Phase 6 — Privilege Escalation Review

Assess potential privilege escalation opportunities.

Review:

IAM Policy chaining
AssumeRole permissions
Managed Identity abuse
Service Account abuse
Cross-account trust
Cross-project trust
Temporary credential abuse
Resource policy weaknesses

Determine:

Lateral movement paths
Administrative escalation
Cross-cloud trust risks

Deliverables

Privilege Escalation Analysis

Phase 7 — Zero Trust Assessment

Review whether the environment follows Zero Trust principles.

Assess:

Identity verification
Continuous authentication
Least Privilege
Micro-segmentation
Conditional Access
Device trust
Context-aware access

Evaluate whether access decisions are based on identity, context, and risk rather than implicit trust.

Deliverables

Zero Trust Assessment

Phase 8 — Identity Monitoring

Review monitoring capabilities.

Assess:

AWS

CloudTrail
IAM Access Analyzer
GuardDuty

Azure

Microsoft Entra ID Logs
Azure Monitor
Microsoft Sentinel

Google Cloud

Cloud Audit Logs
Cloud Logging
Security Command Center

Review:

Failed logins
Permission changes
API abuse
Privilege escalation alerts
Identity anomalies

Deliverables

Identity Monitoring Assessment

Phase 9 — Risk Analysis

Classify findings using enterprise risk ratings.

Severity	Description
Critical	Immediate identity compromise risk
High	Significant privilege escalation opportunity
Medium	Identity weakness requiring remediation
Low	Minor configuration improvement
Informational	Best practice recommendation

Prioritize findings based on:

Business impact
Likelihood
Exploitability
Compliance impact

Evidence Collection Checklist

Collect evidence for:

IAM Roles
IAM Policies
Managed Identities
Service Accounts
API Gateway configuration
Azure API Management configuration
Google API Gateway configuration
Authentication settings
Authorization policies
Resource policies
Identity logs
Access Analyzer findings
Security alerts

Executive Deliverables

Prepare:

Executive Summary
Identity Architecture Review
IAM Assessment
Authentication Assessment
Authorization Assessment
API Security Review
Privilege Escalation Analysis
Zero Trust Assessment
Monitoring Assessment
Risk Register
Security Scorecard
Prioritized Remediation Roadmap

Common Enterprise Findings

Identity and API assessments frequently identify:

Overly permissive IAM roles
Administrator execution identities
Wildcard permissions
Shared Service Accounts
Public APIs without authentication
Weak JWT validation
Missing rate limiting
Broken authorization logic
Cross-account trust abuse
Poor identity governance

Success Criteria

The assessment is complete when you have:

Inventoried all serverless identities.
Assessed IAM permissions across all cloud providers.
Validated authentication and authorization mechanisms.
Reviewed API security controls.
Identified privilege escalation paths.
Evaluated Zero Trust maturity.
Prioritized risks according to business impact.
Produced executive-ready consulting documentation.

Consultant Tips

During enterprise identity and API assessments:

Begin with identity architecture before reviewing APIs.
Verify that every API request is authenticated and authorized.
Review trust relationships carefully, as they are common privilege escalation paths.
Confirm that execution identities follow the Principle of Least Privilege.
Validate API rate limiting, token validation, and WAF protection.
Correlate identity activity with API logs during investigations.
Support every finding with evidence and business impact.

Runbook Summary

This runbook provides a structured methodology for assessing serverless identities, authentication, authorization, API security, privilege escalation risks, and Zero Trust implementation across AWS, Microsoft Azure, and Google Cloud.

Following this process enables Cloud Penetration Testers and Cloud Security Consultants to consistently evaluate identity security, identify weaknesses, prioritize remediation, and deliver executive-level consulting reports using the GoHackersCloud Enterprise Serverless Security Assessment Framework.

Next Runbook

➡️ Runbook 03 — Enterprise Serverless Investigation

In the next runbook, you will investigate a suspected compromise within a multi-cloud serverless environment by analyzing identities, APIs, event sources, audit logs, monitoring data, attack timelines, and forensic evidence to perform a complete enterprise incident investigation.