Search for a command to run...
Miguel is a Principal Engineer and the author of the “Serverless Security” book. He has worked on multiple serverless projects as a developer and security engineer, contributed to open-source serverless projects, and worked on large military systems in various engineering roles.
No comments yet. Be the first to comment.
We will discuss aspects serverless security, and describe what you can do to start securing your serverless application. Visit <https://ServerlessSecurityBook.com> to level up and get the book.
There are some wonderful free or open-source tools you can use to improve the security of your serverless projects. We will explore these tools in five areas. 1. Linters Linters help improve your code by finding common coding flaws. You would typical...
Protect your system from vulnerabilities
How I saved my company $1 million
This YouTube video series provides quick overviews of the top 10 cybersecurity risks for serverless applications. Each video covers the risk and some recommendations on how to address it. Why is the OWASP Serverless Top 10 important? In this video, I...
![Overview of the OWASP Serverless Top 10 [videos]](/_next/image?url=https%3A%2F%2Fcdn.hashnode.com%2Fres%2Fhashnode%2Fimage%2Fupload%2Fv1636408504092%2FBcNttK9q2.png&w=3840&q=75)
A little over one year ago, I published my first book thanks to Apress and author Nihad Hassan. I am in a cybersecurity writing group with Nihad, where he shared he had published his 4th book; this was back in 2019. I was impressed by his accomplishm...
You may have heard, “If you build it, they will come.” Have you heard, “If you build it, I will break it?” This is a skill I developed over my career to build better systems. It is a skill that took me a while to learn I had. Shortly before I graduat...
Miguel's Blog · Serverless · Security
49 posts
Miguel A. Calles is the author of the Serverless Security book, and a Cybersecurity engineer who works on serverless and cloud computing projects.
The Serverless Framework support numerous plugins—and they are great! They save so much time in deploying our serverless applications. Why reinvent the wheel? This convenience comes with a downside: not all plugins are written securely. We must choose our plugins wisely, which means we should inspect the source code.
The Serverless Framework allow us to use plugins (or create one) that hook into the lifecycle events during the deploy process. We can hook into the "before:deploy:deploy" event to setup files and variables before the deploy begins. We can hook into the "deploy:finalize" hook to save some information about the deployment. There are numerous possibilities that plugins enable.
There are plugins that:
And many more.
To use a plugin, we install the npm package:
npm install --save-dev serverless-iam-roles-per-function
Add the plugin to our Serverless configuration file (serverless.yml):
plugins:
- serverless-iam-roles-per-function
And, follow any instructions and settings the plugin requires.
We have now improved and simplifies our serverless deployment.
The plugins are built by the Serverless community. Anyone can create a plugin. The Serverless Framework company lists plugins, but only a subset are "approved." This means we should be cognizant of what we are using.
One plugin, allows us to add if-else statements in our serverless.yml file: Serverless Plugin IfElse plugin. This plugin is useful because we can adjust our Serverless configuration depending on the deployment scenario.
For example, we can deploy functions specific to our dev stage, and exclude them from the others.
service: insecure-plugins
provider:
name: aws
runtime: nodejs12.x
stage: ${opt:stage, 'dev'}
region: us-east-1
functions:
dev:
handler: dev.handler
plugins:
- serverless-plugin-ifelse
custom:
serverlessIfElse:
- If: '"${self:provider.stage}" != "dev"'
Exclude:
- functions.dev
Our dev stage will deploy the dev function to the dev stage and all other stages will not have it. Nice!
After inspecting the code, I saw something interesting on line 27 for how it evaluate the if statement.
if (eval(item.If)) {
Let's see if this works as we expect.
I updated my serverless.yml to include some Node code.
service: insecure-plugins
provider:
name: aws
runtime: nodejs12.x
stage: ${opt:stage, 'dev'}
region: us-east-1
functions:
dev:
handler: dev.handler
plugins:
- serverless-plugin-ifelse
custom:
serverlessIfElse:
# - If: '"${self:provider.stage}" != "dev"'
- If: 'const cp = require("child_process"); cp.execSync("touch hello.txt");'
Exclude:
- functions.dev
I deployed the configuration and noticed the following:
dev function because the if statement does not return a truthy value.hello.txt in the folder.This is an example how a plugin can reduce our security posture. Granted, someone would have to insert a rogue command and get it past us in the code review process for this exploit to work. Keep in mind, the plugin code could do something malicious because it has access to the AWS services permitted by the IAM policies used to deploy the Serverless configuration.
Serverless Framework plugins are great, but we need to understand what they do by inspecting the source code. We must be careful to understand whether they can potentially do something malicious.
View the source code at https://github.com/miguel-a-calles-mba/secjuice/tree/master/insecure-plugins.
Originally published on Secjuice.com
Photo by Dmitry Ratushny on Unsplash