Lion Cipher Lab

Secure Lambda layers and the dependency supply chain: the code you didn't write is still your risk

• Cloud Security
• Intermediate
• 75 minutes
• Free · no account required

Why it matters

The first two serverless labs taught you that in Lambda there is no host to patch and no port to close, so the execution role and the network are the whole perimeter. That is true — but it hides a second half of the shared-responsibility bargain. AWS patches the runtime and the operating system underneath your function. It does NOT patch the third-party libraries you import. Every `pip install` pulls in code written by strangers that will run inside your function, with your function's execution role, on your account — and a large fraction of real serverless incidents are not clever attacks on…

What you'll learn

• the second half of serverless shared responsibility: AWS patches the OS, you own your code AND its dependencies
• defining supply-chain risk: a third-party library is code you run but did not write, and a bad one is a breach path
• what a Lambda layer is, and why a shared layer centralizes third-party code across every function that attaches it
• packaging a dependency into a layer with the correct python/ directory structure inside the .zip
• publishing a layer version with aws lambda publish-layer-version and attaching it to a function
• generating a software bill of materials (SBOM) so you know exactly which libraries and versions you are running
• scanning dependencies for known CVEs with pip-audit and reading what a CVE hit actually means
• pinning exact versions with hashes and installing with pip --require-hashes to defeat typosquatting and dependency confusion
• the rule on public/third-party layer ARNs: a public layer is a stranger's code running in your account
• shifting the scan left into CI and enabling Amazon Inspector for Lambda as the managed, continuous 'do it better'

Steps in this lab

1. The other half of serverless: you still own the code you didn't write
2. Set your Region and your budget contract before you build anything
3. Build a function that NEEDS a library it doesn't have — and watch it crash
4. Package the dependency as a LAYER — the python/ structure everyone gets wrong
5. The risk made visible: inventory the layer (SBOM) and scan it for CVEs
6. The fix: pin exact versions WITH HASHES so the bytes you scanned are the bytes that run
7. Harden and do it better: own your layers, scan in CI, let Inspector watch
8. Judgment: when a public layer is fine, and why 'it works in the demo' isn't 'it's safe'
9. Clean up: delete the function, every layer version, and the role
10. What you did, and why it matters

Open the full interactive lab →