aws-samples / aws-serverless-security-workshop

In this workshop, you will learn techniques to secure a serverless application built with AWS Lambda, Amazon API Gateway and RDS Aurora. We will cover AWS services and features you can leverage to improve the security of a serverless applications in 5 domains: identity & access management, code, data, infrastructure, logging & monitoring.

Serverless Security Workshop

WARNING: The purpose of the workshop is to provide a starter API which does NOT follow many security best practices on purpose. The tutorial modules guide you to identify security gaps in the starter app, and implement protection measures for them.

Furthermore, the modules do not cover ALL the security measures that should be applied. After completing all modules, we recommend you to explore additional protections, such as ensuring the principle of least privilege. See the Extra Credit section for more details.

In this workshop, you will learn techniques to secure a serverless application built with AWS Lambda, Amazon API Gateway and RDS Aurora. We will cover AWS services and features you can leverage to improve the security of a serverless applications in 5 domains:

1. identity & access management
2. infrastructure
3. data
4. code
5. logging & monitoring

Getting Started

Workshop URL: serverless-security-workshop

License Summary

The documentation is made available under the Creative Commons Attribution-ShareAlike 4.0 International License. See the LICENSE file.

The sample within this documentation is made available under a modified MIT license. See the LICENSE-SAMPLECODE file.

aws-serverless-security-workshop's Issues

CloudFormation deployment fails (eu-west-1)

The CloudFormation deployment fails with "instances cannot be added to Aurora Serverless clusters".
As diving a bit deeper in to the issue the db.t2.small is not available in eu-west-1. Also the deployment tries to create serverless cluster which doesn't accept instances to be added.

db.t2.small -> db.t3.small

engine: aurora -> engine: aurora-mysql

Improvement on cloudformation deployment command

On Module-0F, step 2.
Should add an instruction to add InitResourceStack bash variable so that users do not need to replace deployment command from InitResourceStack=Secure-Serverless to InitResourceStack=mod-xxxx.

eg. InitResourceStack=$InitResourceStack

Apply least privilege principals

The purpose of this workshop is to teach security concepts, but a quick skim shows a lambda being giving cognito-idp:* on * and dynamodb:* on *. These should be trimmed up.

aws-serverless-security-workshop/src/template.yaml

Line 52 in c949379

- "dynamodb:*"

Nodejs8.10 is no longer supported as a runtime

Module 1
nodejs8.10 is no longer a supported runtime - which causes SAM to fail to update the stackset.

Runtime: nodejs8.10

Cannot open the SVS305-Secure-Serverless.pdf

Hi,

An error message displayed when I try to open the SVS305-Secure-Serverless.pdf Please check.

Aurora RDS instance has old CA cert

Got the notification that it's using the old certificate for RDS. Can the template be updated to handle this?

FYI. Module 0. npm install - found 1 high severity vulnerability

found 1 high severity vulnerability
run npm audit fix to fix them, or npm audit for details
High │ Regular Expression Denial of Service
Package │ minimatch
More info │ https://npmjs.com/advisories/118

Change in JDK build # in EXPORT

The current export under "Downloading the latest Java jdk" reads:

export JAVA_HOME=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-0.42.amzn1.x86_64/jre

... however this causes the error "We cannot execute /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-0.42.amzn1.x86_64/jre/bin/java". The exports needs to be updated to:

export JAVA_HOME=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.201.b09-0.43.amzn1.x86_64/jre

Update Dependency Check Tool

Under "Dependency vulnerability with OWASP Dependency Check" --> "Downloading the tool", update bullet #2 so the wget command reads:

wget -O dependency-check-5.1.0-release.zip http://dl.bintray.com/jeremy-long/owasp/dependency-check-5.1.0-release.zip

The existing version errors out with - "[ERROR] The download was interrupted; unable to complete the update".

Require ImageId for Cloud9 env creation in CloudFormation

From December 04, 2023, you will be required to include the imageId parameter for the CreateEnvironmentEC2 action. This change will be reflected across all direct methods of communicating with the API, such as AWS SDK, AWS CLI and AWS CloudFormation.

Unable to create the CloudFormation stack without this new parameter.

Wrong Postman step on module 1E

On module 1E, Step 2, it says:
"In the Edit Folder window that pops up, go to Authorization tab, and change the Auth Type to OAuth 2.0, then click Get New Access Token"

You should not click "Get New Access Token" until step 3 is completed, otherwise you will be making an empty request that will fail.
https://github.com/aws-samples/aws-serverless-security-workshop/tree/master/docs/01-add-authentication#module-1e-use-the-admin-client-to-register-new-partner-companies

withRouter no longer in react-router-dom

Compiling of website code for Wild Ryde failed when I went through the project due to the use of the withRouter method, which is no longer in the react-router-dom library.

AWS Resources will be deprecated on Cloud9

On the "Module-0E: Run your serverless application locally with SAM Local", we are making reference to using AWS Resources, which is disabled by default since Cloud9 uses AWS Toolkit since 2020.

Page: https://github.com/aws-samples/aws-serverless-security-workshop/tree/master/docs/00-initial-setup

"For Lambda functions, the AWS Resources window will soon be replaced by the AWS Toolkit for Cloud9. Try it now by chooshing Preferences > AWS Settings > AWS Toolkit" Reference to Toolkit: https://docs.aws.amazon.com/cloud9/latest/user-guide/toolkit-welcome.html