Application Security & DevSecOps Agents
Problem Statement
Serverless functions (AWS Lambda, Azure Functions) are often created with overly broad IAM execution roles (e.g., Resource: "*"), leaving them vulnerable to event injection attacks and cloud resource abuse.
Goal
Deploy an agent that analyzes serverless function code alongside execution role policies to enforce least-privilege permissions.
Outcome Measurement
- Permission Reduction: 90% reduction in overly broad IAM permissions assigned to serverless execution roles.
- Code Safety: Zero undetected event injection vulnerabilities in scanned functions.
How the Code was Built
Analyzes serverless handlers for dynamic evaluation flaws while mapping required SDK calls to IAM actions.
Executable Code
from pydantic import BaseModel, Fieldfrom langchain_openai import ChatOpenAIclass ServerlessAudit(BaseModel): function_name: str event_injection_risk: bool overprivileged_permissions: list[str] minimal_iam_policy: strdef audit_serverless_function(function_code: str, iam_role_policy: str) -> ServerlessAudit: llm = ChatOpenAI(model="gpt-4o", temperature=0) structured_llm = llm.with_structured_output(ServerlessAudit) prompt = f"""Audit Serverless Function Code and Assigned IAM Policy:CODE:{function_code}IAM POLICY:{iam_role_policy}Identify event injection flaws and output least-privilege IAM policy.""" return structured_llm.invoke(prompt)if __name__ == "__main__": code = "import boto3\ndef lambda_handler(event, context):\n s3 = boto3.client('s3')\n s3.download_file(event['bucket'], event['key'], '/tmp/out')" policy = '{"Statement": [{"Effect": "Allow", "Action": "s3:*", "Resource": "*"}]}' res = audit_serverless_function(code, policy) print(f"Injection Risk: {res.event_injection_risk}") print(f"Excessive Rights: {res.overprivileged_permissions}") print("Minimal Policy:\n", res.minimal_iam_policy)
Leave a Reply