Prisma Cloud Compute Edition Administrator’s Guide
    : Serverless Defender as a Lambda layer
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma
    3. Prisma Cloud
    4. Prisma Cloud Compute Edition Administrator’s Guide
    5. Install
    6. Install Defender
    7. Serverless Defender as a Lambda layer
    Download PDF

    Prisma Cloud Compute Edition Administrator’s Guide

    Serverless Defender as a Lambda layer

    Table of Contents
    End-of-Life (EoL)

    Serverless Defender as a Lambda layer

    Prisma Cloud Serverless Defenders protect serverless functions at runtime. Currently, Prisma Cloud supports AWS Lambda functions.
    Lambda layers are ZIP archives that contain libraries, custom runtimes, or other dependencies. Layers let you add reusable components to your functions, and focus deployment packages on business logic. They are extracted to the /opt directory in the function execution environment. For more information, see the AWS Lambda layers documentation.
    Prisma Cloud delivers Serverless Defender as a Lambda layer. Deploy Serverless Defender to your function by wrapping the handler and setting an environment variable. See system requirements for the runtimes that are supported for Serverless Defender as a Lambda layer.

    Securing serverless functions

    To secure an AWS Lambda function with the Serverless Defender layer:
    1. Download the Serverless Defender Lambda layer ZIP file.
    2. Upload the layer to AWS.
    3. Define a serverless protection runtime policy.
    4. Define a serverless WAAS policy.
    5. Add the layer to your function, update the handler, and set an environment variable. After completing this integration, Serverless Defender runs when your function is invoked.

    Download the Serverless Defender layer

    Download the Serverless Defender layer from Compute Console.
    1. Open Console, then go to
      Manage > Defenders > Deploy> Defenders > Single Defender
      .
    2. Choose the DNS name or IP address that Serverless Defender uses to connect to Console.
    3. Set the Defender type to
      Serverless Defender
      .
    4. Select a runtime.
      Prisma Cloud supports Lambda layers for
      Node.js
      ,
      Python
      , and
      Ruby
       only.
    5. For
      Deployment Type
      , select
      Layer
      .
    6. Download the Serverless Defender layer. A ZIP file is downloaded to your host.

    Upload the Serverless Defender layer to AWS

    Add the layer to the AWS Lambda service as a resource available to all functions.
    1. In the AWS Management Console, go to the Lambda service.
    2. Select
      Layers > Create Layer
      .
    3. In
      Name
      , enter
      twistlock
      .
    4. Click
      Upload
      , and select the file you just downloaded, twistlock_defender_layer.zip
      1. Select the compatible runtimes:
        Python
        ,
        Node.js
        , or
        Ruby
        .
      2. Click
        Create
        .

    Defining your runtime protection policy

    By default, Prisma Cloud ships with an empty serverless runtime policy. An empty policy disables runtime defense entirely.
    You can enable runtime defense by creating a rule. By default, new rules:
    • Apply to all functions (*), but you can target them to specific functions by function name.
    • Block all processes from running except the main process. This protects against command injection attacks.
    When functions are invoked, they connect to Compute Console and retrieve the latest policy. To ensure that functions start executing at time=0 with your custom policy, you must predefine the policy. Predefined policy is embedded into your function along with the Serverless Defender by way of the TW_POLICY environment variable.
    1. Log into Prisma Cloud Console.
    2. Go to
      Defend > Runtime > Serverless Policy
      .
    3. Click
      Add rule
      .
    4. In the
      General
       tab, enter a rule name.
    5. (Optional) Target the rule to specific functions.
    6. Set the rule parameters in the
      Processes
      ,
      Networking
      , and
      File System
       tabs.
    7. Click
      Save
      .

    Defining your serverless WAAS policy

    Prisma Cloud lets you protect your serverless functions against application layer attacks by utlizing the serverless Web Application and API Security (WAAS).
    By default, the serverless WAAS is disabled. To enable it, add a new serverless WAAS rule.
    1. Log into Prisma Cloud Console.
    2. Go to
      Defend > WAAS > Serverless
      .
    3. Click
      Add rule
      .
    4. In the
      General
       tab, enter a rule name.
    5. (Optional) Target the rule to specific functions.
    6. Set the protections you want to apply (
      SQLi
      ,
      CMDi
      ,
      Code injection
      ,
      XSS
      ,
      LFI
      ).
    7. Click
      Save
      .

    Embed the Serverless Defender

    Embed the Serverless Defender as a layer, and run it when your function is invoked. If you are using a deployment framework such as SAM or Serverless Framework you can reference the layer from within the configuration file.
    Prerequisites:
    • You already have a Lambda function.
    • Your Lambda function is written for Node.js, Python, or Ruby.
    • Your function’s execution role grants it permission to write to CloudWatch Logs. Note that the
      AWSLambdaBasicExecutionRole
       grants permission to write to CloudWatch Logs.
    1. Go to the function designer in the AWS Management Console.
    2. Click on the
      Layers
       icon.
    3. In the
      Referenced Layers
       panel, click
      Add a layer
      .
      1. In the
        Select from list of runtime compatible layers
        , select
        twistlock
        .
      2. In the
        Version
         drop-down list, select
        1
        .
      3. Click
        Add
        .
        When you return to the function designer, you’ll see that your function now uses one layer.
    4. Update the handler for your function to be twistlock.handler.
    5. Set the TW_POLICY and ORIGINAL_HANDLER environment variable, which specifies how your function connects to Compute Console to retrieve policy and send audits.
      1. In Compute Console, go to
        Manage > Defenders > Deploy > Single Defender
        .
      2. For
        Defender type
        , select
        Serverless
        .
      3. In
        Set the Twistlock environment variable
        , enter the function name and region.
      4. Copy the generated
        Value
        .
      5. In AWS Console, open your function in the designer, and scroll down to the
        Environment variables
         panel.
      6. For
        Key
        , enter TW_POLICY.
      7. For
        Value
        , paste the rule you copied from Compute Console.
      8. For ORIGINAL_HANDLER, this is the original value of handelr for your function before your modification.
    6. Click
      Save
       to preserve all your changes.

    Recommended For You

    © 2023 Palo Alto Networks, Inc. All rights reserved.