Serverless Defender (auto-protect)

Serverless auto-protect lets you automatically add the Serverless Defender to the AWS Lambda functions deployed in your account. Prisma Cloud uses the AWS API to deploy the Serverless Defender as a Lambda layer based on the auto-protect rules.
It is an additional option for deploying the Serverless Defender, on top of manually adding it as a dependency or adding it as a Lambda layer.
Serverless auto-protect supports the following runtimes:
  • Node.js 10.x
  • Python 2.7, 3.6, and 3.7

Limitations

Auto-protect is implemented with a layer. AWS Lambda has a limit of five layers per function. If your functions have mutiple layers, and they might exceed the layer limit with auto-protect, consider protecting them with the embedded option.

Required permissions

Prisma Cloud needs the following permissions to automatically protect Lambda functions in your AWS account. Add the following policy to an IAM user or role:
{ "Version": "2012-10-17", "Statement": [ { "Sid": "PrismaCloudServerlessAutoProtect", "Effect": "Allow", "Action": [ "lambda:PublishLayerVersion", "lambda:UpdateFunctionConfiguration", "lambda:GetLayerVersion", "lambda:GetFunctionConfiguration", "iam:SimulatePrincipalPolicy" ], "Resource": "*" } ] }

Serverless auto-protect rules

To secure one or multiple AWS Lambda functions using serverless auto-protect:
  1. Define a serverless protection runtime policy.
  2. Define a serverless CNAF policy.
  3. Add a serverless auto-protect rule.

Defining your runtime protection policy

Prisma Cloud ships with a default runtime policy for all serverless functions that blocks all processes from running except the main process. This default policy protects against command injection attacks.
You can customize the policy with additional rules. By default, new rules apply to all functions (
*
), but you can target them to specific functions by function name.
When functions are invoked, they connect to Compute Console and retrieve the latest policy. To ensure that functions start executing at time=0 with your custom policy, you must predefine the policy. Predefined policy is embedded into your function along with the Serverless Defender by way of the
TW_POLICY
environment variable.
  1. Log into Prisma Cloud Console.
  2. Go to
    Defend > Runtime > Serverless Policy
    .
  3. Click
    Add rule
    .
  4. In the
    General
    tab, enter a rule name.
  5. (Optional) Target the rule to specific functions.
    In
    Functions
    , enter a function name. Use pattern matching to refine how the rule is applied.
  6. Set the rule parameters in the
    Processes
    ,
    Networking
    , and
    File System
    tabs.
  7. Click
    Save
    .

Defining your serverless CNAF policy

Prisma Cloud lets you protect your serverless functions against application layer attacks by utlizing the serverless Cloud Native Application Firewall (CNAF).
By default, the serverless CNAF is disabled. To enable it, add a new serverless CNAF rule.
  1. Log into Prisma Cloud Console.
  2. Go to
    Defend > Firewalls > Cloud Native Application Firewall > Serverless
    .
  3. Click
    Add rule
    .
  4. In the
    General
    tab, enter a rule name.
  5. (Optional) Target the rule to specific functions.
    In
    Functions
    , enter a function name. Use pattern matching to refine how the rule is applied.
  6. Set the protections you want to apply (
    SQLi
    ,
    CMDi
    ,
    Code injection
    ,
    XSS
    ,
    LFI
    ).
  7. Click
    Save
    .

Add a serverless auto-protect rule

The serverless auto-protect rules let you specify which functions you want to protect. You can define a specific account by referencing the relevant credential, region, function pattern name, and runtimes. Each auto-protect rule is evaluated separately.
  1. Open Compute Console, and go to
    Manage > Defenders > Deploy > Serverless Auto-Protect
    .
  2. Click on
    Add rule
    .
  3. In the dialog, enter the following settings:
    1. Choose the rule name.
    2. In
      Provider
      - only AWS is supported.
    3. Specify a region.
    4. Specify a console name.
    5. Select or create credentials so that Prisma Cloud can access your account.
      • AWS — Specify either an IAM user credential (access key ID and secret access key) or IAM role.
    6. Specify the functions.
      Wildcards are supported.
    7. Specify the runtimes.
    8. Click
      Add
      .
  4. The new rule should now appear in the
    Rules
    table.
  5. Click on
    Apply
    .
    By default, the serverless auto-protect rules are evaluated every 24 hours.

Recommended For You