1. Home
    2. Prisma
    3. Prisma Cloud
    4. Prisma Cloud Compute Edition Administrator’s Guide
    5. Install
    6. Install Defender
    7. Auto-defend serverless functions

    Auto-defend serverless functions

    Serverless auto-defend lets you automatically add the Serverless Defender to the AWS Lambda functions deployed in your account. Prisma Cloud uses the AWS API to deploy the Serverless Defender as a Lambda layer based on the auto-defend rules.
    It is an additional option for deploying the Serverless Defender, on top of manually adding it as a dependency or adding it as a Lambda layer.
    Serverless auto-defend supports the following runtimes:
    • Node.js 12.x, 14.x
    • Python 3.6, 3.7, 3.8
    • Ruby 2.7

    Limitations

    Auto-protect is implemented with a layer. AWS Lambda has a limit of five layers per function. If your functions have mutiple layers, and they might exceed the layer limit with auto-defend, consider protecting them with the embedded option.

    Required permissions

    Prisma Cloud needs the following permissions to automatically protect Lambda functions in your AWS account. Add the following policy to an IAM user or role:
    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "PrismaCloudComputeServerlessAutoProtect",
            "Effect": "Allow",
            "Action": [
                "lambda:PublishLayerVersion",
                "lambda:UpdateFunctionConfiguration",
                "lambda:GetLayerVersion",
                "lambda:GetFunctionConfiguration",
                "iam:SimulatePrincipalPolicy",
                "lambda:GetFunction",
                "lambda:ListFunctions",
                "iam:GetPolicyVersion",
                "iam:GetRole",
                "iam:ListRolePolicies",
                "iam:ListAttachedRolePolicies",
                "iam:GetRolePolicy",
                "iam:GetPolicy",
                "lambda:ListLayerVersions",
                "lambda:ListLayers",
                "lambda:DeleteLayerVersion",
                "kms:Decrypt",
                "kms:Encrypt",
                "kms:CreateGrant"
            ],
            "Resource": "*"
        }
    ]
}

    Serverless auto-defend rules

    To secure one or multiple AWS Lambda functions using serverless auto-defend:
    1. Define a serverless protection runtime policy.
    2. Define a serverless WAAS policy.
    3. Add a serverless auto-defend rule.

    Defining your runtime protection policy

    By default, Prisma Cloud ships with an empty serverless runtime policy. An empty policy disables runtime defense entirely.
    You can enable runtime defense by creating a rule. By default, new rules:
    • Apply to all functions (*), but you can target them to specific functions by function name.
    • Block all processes from running except the main process. This protects against command injection attacks.
    When functions are invoked, they connect to Compute Console and retrieve the latest policy. To ensure that functions start executing at time=0 with your custom policy, you must predefine the policy. Predefined policy is embedded into your function along with the Serverless Defender by way of the TW_POLICY environment variable.
    1. Log into Prisma Cloud Console.
    2. Go to
      Defend > Runtime > Serverless Policy
      .
    3. Click
      Add rule
      .
    4. In the
      General
       tab, enter a rule name.
    5. (Optional) In
      Scope
      , target the rule to specific functions.
      Create a new collection. In the
      Functions
       field, enter a function name. Use pattern matching to refine how it’s applied.
    6. Set the rule parameters in the
      Processes
      ,
      Networking
      , and
      File System
       tabs.
    7. Click
      Save
      .

    Defining your serverless WAAS policy

    Prisma Cloud lets you protect your serverless functions against application layer attacks by utlizing the serverless