Lion Cipher Lab

Secure an AWS Lambda function: the execution role is the perimeter

• Cloud Security
• Intermediate
• ~75 min
• Free · no account required

Why it matters

Every hardening habit you have built so far assumes a server: patch it, close its ports, lock down SSH, watch its logs. Serverless deletes all of that. AWS runs and patches the execution environment, there is nothing to log into, and there is no host firewall to write. What remains — and it is now the ENTIRE blast radius — is the function's execution role and whatever the function trusts as input. That is why the classic serverless incident is not a compromised box but a small bug or a poisoned dependency running inside a function whose role could touch every bucket in the account. This lab…

What you'll learn

• the serverless shared-responsibility shift (no patching, no SSH, no host firewall)
• creating a Lambda execution role with the lambda.amazonaws.com trust policy
• proving a function's identity with sts:GetCallerIdentity from inside the handler
• seeing the runtime-injected AWS_ACCESS_KEY_ID / AWS_SESSION_TOKEN credentials
• replacing a broad managed policy with an inline policy scoped to one resource ARN
• reading an AccessDenied as proof that a scope-down worked
• getting secrets out of plaintext environment variables (SSM SecureString / Secrets Manager)
• restricting who may lambda:InvokeFunction with a resource-based policy
• why a Function URL with AuthType NONE is a public endpoint
• CloudWatch Logs retention, and what CloudTrail does and does not record for Lambda

Steps in this lab

1. The shift: there is no server, so the ROLE is the perimeter
2. Set your Region and your budget contract before you touch anything
3. Write a handler that reports on its own identity and reach
4. Create the execution role — and read its trust policy carefully
5. Deploy it with a deliberately over-broad role, and look at what it can see
6. Where the credentials came from: the runtime hands the role to ANY code in the process
7. Scope it down: one inline policy, one bucket ARN — and watch the extra calls die
8. Get the secret out of the environment variable
9. Close the front door: who may invoke this function, and the Function URL trap
10. Make it investigable: logs, retention, and what CloudTrail will not tell you
11. The judgment: one role per function, and what this lab did not cover
12. Tear it all down

Open the full interactive lab →