End-of-Life (EoL)

Serverless Defender as a Lambda layer

Prisma Cloud Serverless Defenders protect serverless functions at runtime. Currently, Prisma Cloud supports AWS Lambda functions.
Lambda layers are ZIP archives that contain libraries, custom runtimes, or other dependencies. Layers let you add reusable components to your functions, and focus deployment packages on business logic. They are extracted to the /opt directory in the function execution environment. For more information, see the AWS Lambda layers documentation.
Prisma Cloud delivers Serverless Defender as a Lambda layer. Deploy Serverless Defender to your function by wrapping the handler and setting an environment variable.
The following runtimes are supported for Serverlerss Defender as a Lambda layer:
  • Node.js 8.x
  • Python 2.7, 3.6, and 3.7

Securing serverless functions

To secure an AWS Lambda function with the Serverless Defender layer:
  1. Download the Serverless Defender Lambda layer ZIP file.
  2. Upload the layer to AWS.
  3. Define your policy.
  4. Add the layer to your function, wrap your handler, and set an environment variable. After completing this integration, Serverless Defender runs when your function is invoked.

Download the Serverless Defender layer

Download the Serverless Defender layer from Compute Console.
  1. Open Console, then go to
    Manage > Defenders > Deploy
  2. Choose the DNS name or IP address that Serverless Defender uses to connect to Console.
  3. Set the Defender type to
  4. Select a runtime.
    Prisma Cloud supports Lambda layers for
  5. For
    Deployment Type
    , select
  6. Download the Serverless Defender layer. A ZIP file is downloaded to your host.

Upload the Serverless Defender layer to AWS

Add the layer to the AWS Lambda service as a resource available to all functions.
  1. In the AWS Management Console, go to the Lambda service.
  2. Click
  3. In
    , enter
  4. Click
    , and select the file you just downloaded, twistlock_defender_layer.zip
    1. Select the compatible runtimes:
    2. Click

Define policy

Policies are defined in Compute Console. Prisma Cloud ships with a default runtime policy that protects against command injection attacks. This policy is applied to all functions in your environment.
You can customize the policy with additional rules. By default, new rules apply to all functions (*), but you can target them to specific functions by function name. When functions are invoked, they connect to Compute Console to retrieve the latest policy. To ensure functions start executing at time=0 with your custom policy, however, predefine the policy. Predefined policy is embedded into your function along with Serverless Defender by way of the TW_POLICY environment variable.
You can review policy violation audits in CloudWatch Logs and Compute Console. To view audits in CloudWatch logs, click
, then click
View logs in CloudWatch
. To view audits in Compute Console, go to
Monitor > Events > Serverless Audits
  1. Log into Compute Console.
  2. Go to
    Defend > Runtime > Serverless Policy
  3. Click
    Add rule
  4. In the
    tab, enter a rule name.
  5. (Optional) Target the rule to specific functions.
    , enter a function name. Use pattern matching to refine how the rule is applied.
  6. Set the rule parameters in the
    , and
    File System
  7. Click

Embed the Serverless Defender

Embed the Serverless Defender as a layer, and run it when your function is invoked.
  • You already have a Lambda function.
  • Your Lambda function is written for Node.js 8 or Python.
  • Your function’s execution role grants it permission to write to CloudWatch Logs. Note that the
    grants permission to write to CloudWatch Logs.
  1. Go to the function designer in the AWS Management Console.
  2. Click on the
  3. In the
    Referenced Layers
    panel, click
    Add a layer
    1. In the
      Select from list of runtime compatible layers
      , select
    2. In the
      drop-down list, select
    3. Click
      When you return to the function designer, you’ll see that your function now uses one layer.
  4. Import the Serverless Defender layer into your function by adding the appropriate line to your code depending on your runtime.
    • If your runtime is
      , wrap your function’s handler as follows:
      import twistlock @twistlock.serverless.handler def handler(event, context): . . .
    • If your runtime is
      , and your handler is asynchronous, wrap your function as follows:
      // Async handler var twistlock = require('twistlock'); exports.handler = async (event, context) => { . . . };
    • If your runtime is
      , and your handler is synchronous, wrap your function as follows:
      // Non-async handler var twistlock = require('twistlock'); exports.handler = (event, context, callback) => { . . . }; exports.handler = twistlock.handler(exports.handler);
  5. Set the TW_POLICY environment variable, which specifies how your function connects to Compute Console to retrieve policy and send audits.
    1. In Compute Console, go to
      Manage > Defenders > Deploy > Single Defender
    2. For
      Defender type
      , select
    3. In
      Set the Twistlock environment variable
      , enter the function name.
    4. Copy the generated
    5. In AWS Console, open your function in the designer, and scroll down to the
      Environment variables
    6. For
      , enter TW_POLICY.
    7. For
      , paste the rule you copied from Compute Console.
  6. Click
    to preserve all your changes.

Recommended For You