[{"data":1,"prerenderedAt":87},["ShallowReactive",2],{"content-svc-lambda-guides-governance-6-code-scanning":3},{"markdown":4,"frontMatterAttributes":5,"bodyRaw":10,"menu":11,"menuType":81,"isCollapseableMenu":14,"nextDocItem":66,"previousDocItem":53,"contributorPaths":82,"contentName":86,"slug":65,"readingTime":57},"\u003Cp>\u003Ca href=\"https:\u002F\u002Faws.amazon.com\u002Finspector\u002F\">Amazon Inspector\u003C\u002Fa> is a vulnerability management service that continually scans workloads for known software vulnerabilities and unintended network exposure. Amazon Inspector creates a finding that describes the vulnerability, identifies the affected resource, rates the severity of the vulnerability, and provides remediation guidance.\u003C\u002Fp>\n\u003Cp>Amazon Inspector support for AWS Lambda functions provides continuous, automated security vulnerability assessments for Lambda functions and layers. Amazon Inspector provides two scan types for Lambda:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Lambda standard scanning (default): scans application dependencies within a Lambda function and its layers for \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Finspector\u002Flatest\u002Fuser\u002Ffindings-types.html#findings-types-package\">package vulnerabilities\u003C\u002Fa>.\u003C\u002Fli>\n\u003Cli>Lambda code scanning: scans the custom application code in your functions and layers for \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Finspector\u002Flatest\u002Fuser\u002Ffindings-types.html#findings-types-code\">code vulnerabilities\u003C\u002Fa>. You can either activate Lambda standard scanning or activate Lambda standard scanning together with Lambda code scanning.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>To enable Amazon Inspector, you can navigate to the Amazon Inspector console, expand the Settings section, and choose Account Management. On the Accounts tab, choose Activate, and then select one of two scan options provided.\u003C\u002Fp>\n\u003Cp>You can enable Amazon Inspector for multiple accounts and delegate permissions to manage Amazon Inspector for the organization to specific accounts while setting up Amazon Inspector. While enabling, you need to grant Amazon Inspector permissions by creating the Role: \u003Ccode>AWSServiceRoleForAmazonInspector2\u003C\u002Fcode>. The Amazon Inspector console allows you to create this role using a one-click option. \u003C\u002Fp>\n\u003Cp>For Lambda standard scanning, Amazon Inspector initiates vulnerability scans of Lambda functions in the following situations:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>As soon as Amazon Inspector discovers an existing Lambda function.\u003C\u002Fli>\n\u003Cli>When you deploy a new Lambda function to the Lambda service.\u003C\u002Fli>\n\u003Cli>When you deploy an update to the application code or dependencies of an existing Lambda function or its layers.\u003C\u002Fli>\n\u003Cli>Whenever Amazon Inspector adds a new common vulnerabilities and exposures (CVE) item to its database, and that CVE is relevant to your function.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>For Lambda code scanning, Amazon Inspector evaluates your Lambda function application code using automated reasoning and machine learning that analyzes your application code for an overall security compliance. If Amazon Inspector detects a vulnerability in your Lambda function application code, Amazon Inspector produces a detailed Code Vulnerability type finding. For a list of possible detections, see the \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fcodeguru\u002Fdetector-library\u002F\">CodeGuru Detector Library\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cp>To view the findings, go to the Amazon Inspector console and then on the Findings menu, choose “By Lambda function” to display the security scan results that were performed on Lambda functions.\u003C\u002Fp>\n\u003Cp>To exclude a Lambda function from Lambda standard scanning, tag the function with the following key-value pair: \u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ccode>Key:InspectorExclusion\u003C\u002Fcode>\u003C\u002Fli>\n\u003Cli>\u003Ccode>Value:LambdaStandardScanning\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>To exclude a Lambda function from Amazon Inspector, Lambda code scans tag the function with the following key-value pair: \u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ccode>Key:InspectorCodeExclusion\u003C\u002Fcode>\u003C\u002Fli>\n\u003Cli>\u003Ccode>Value:LambdaCodeScanning\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>For example, as shown in below image, Amazon Inspector automatically detects the vulnerabilities and categorizes the findings of type Code Vulnerability, which indicates that the vulnerability is in the code of the function, and not in one of the code-dependent libraries. You can check these details for a specific function or across multiple functions at once.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"\u002Fassets\u002Fexternal\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002Fassets\u002Fimages\u002F6-code-scanning-findings.png\" alt=\"6-code-scanning-findings\">\u003C\u002Fp>\n\u003Cp>You can further dive deep into each of these findings and learn how to remediate the issue. \u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"\u002Fassets\u002Fexternal\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002Fassets\u002Fimages\u002F6-code-scanning-deep-dive.png\" alt=\"6-code-scanning-deep-dive\">\u003C\u002Fp>\n\u003Cp>While working with your Lambda functions, ensure that you comply with the naming conventions for your Lambda functions. Refer the Lambda environment variables best practices \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Flambda\u002Flatest\u002Fdg\u002Fconfiguration-envvars.html\">here\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cp>You are responsible for the remediation suggestions that you accept. Always review remediation suggestions before accepting them. You may need to make edits to remediation suggestions to ensure that your code does what you intended.\u003C\u002Fp>\n\u003Cp>References: \u003C\u002Fp>\n\u003Col>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Finspector\u002Flatest\u002Fuser\u002Fscanning-lambda.html\">https:\u002F\u002Fdocs.aws.amazon.com\u002Finspector\u002Flatest\u002Fuser\u002Fscanning-lambda.html\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fsecurity\u002Fhow-to-scan-your-aws-lambda-functions-with-amazon-inspector\u002F\">https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fsecurity\u002Fhow-to-scan-your-aws-lambda-functions-with-amazon-inspector\u002F\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Fol>\n",{"title":6,"order":7,"authors":8},"6. Code Scanning with Amazon Inspector",6,[9],"Pallavi Srivastava","[Amazon Inspector](https:\u002F\u002Faws.amazon.com\u002Finspector\u002F) is a vulnerability management service that continually scans workloads for known software vulnerabilities and unintended network exposure. Amazon Inspector creates a finding that describes the vulnerability, identifies the affected resource, rates the severity of the vulnerability, and provides remediation guidance.\n\nAmazon Inspector support for AWS Lambda functions provides continuous, automated security vulnerability assessments for Lambda functions and layers. Amazon Inspector provides two scan types for Lambda:\n\n* Lambda standard scanning (default): scans application dependencies within a Lambda function and its layers for [package vulnerabilities](https:\u002F\u002Fdocs.aws.amazon.com\u002Finspector\u002Flatest\u002Fuser\u002Ffindings-types.html#findings-types-package).\n* Lambda code scanning: scans the custom application code in your functions and layers for [code vulnerabilities](https:\u002F\u002Fdocs.aws.amazon.com\u002Finspector\u002Flatest\u002Fuser\u002Ffindings-types.html#findings-types-code). You can either activate Lambda standard scanning or activate Lambda standard scanning together with Lambda code scanning.\n\nTo enable Amazon Inspector, you can navigate to the Amazon Inspector console, expand the Settings section, and choose Account Management. On the Accounts tab, choose Activate, and then select one of two scan options provided.\n\nYou can enable Amazon Inspector for multiple accounts and delegate permissions to manage Amazon Inspector for the organization to specific accounts while setting up Amazon Inspector. While enabling, you need to grant Amazon Inspector permissions by creating the Role: `AWSServiceRoleForAmazonInspector2`. The Amazon Inspector console allows you to create this role using a one-click option. \n\nFor Lambda standard scanning, Amazon Inspector initiates vulnerability scans of Lambda functions in the following situations:\n\n* As soon as Amazon Inspector discovers an existing Lambda function.\n* When you deploy a new Lambda function to the Lambda service.\n* When you deploy an update to the application code or dependencies of an existing Lambda function or its layers.\n* Whenever Amazon Inspector adds a new common vulnerabilities and exposures (CVE) item to its database, and that CVE is relevant to your function. \n\nFor Lambda code scanning, Amazon Inspector evaluates your Lambda function application code using automated reasoning and machine learning that analyzes your application code for an overall security compliance. If Amazon Inspector detects a vulnerability in your Lambda function application code, Amazon Inspector produces a detailed Code Vulnerability type finding. For a list of possible detections, see the [CodeGuru Detector Library](https:\u002F\u002Fdocs.aws.amazon.com\u002Fcodeguru\u002Fdetector-library\u002F).\n\nTo view the findings, go to the Amazon Inspector console and then on the Findings menu, choose “By Lambda function” to display the security scan results that were performed on Lambda functions.\n\nTo exclude a Lambda function from Lambda standard scanning, tag the function with the following key-value pair: \n\n* `Key:InspectorExclusion`\n* `Value:LambdaStandardScanning`\n\nTo exclude a Lambda function from Amazon Inspector, Lambda code scans tag the function with the following key-value pair: \n\n* `Key:InspectorCodeExclusion`\n* `Value:LambdaCodeScanning`\n\nFor example, as shown in below image, Amazon Inspector automatically detects the vulnerabilities and categorizes the findings of type Code Vulnerability, which indicates that the vulnerability is in the code of the function, and not in one of the code-dependent libraries. You can check these details for a specific function or across multiple functions at once.\n\n![6-code-scanning-findings](\u002Fassets\u002Fexternal\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002Fassets\u002Fimages\u002F6-code-scanning-findings.png)\n\nYou can further dive deep into each of these findings and learn how to remediate the issue. \n\n![6-code-scanning-deep-dive](\u002Fassets\u002Fexternal\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002Fassets\u002Fimages\u002F6-code-scanning-deep-dive.png)\n\nWhile working with your Lambda functions, ensure that you comply with the naming conventions for your Lambda functions. Refer the Lambda environment variables best practices [here](https:\u002F\u002Fdocs.aws.amazon.com\u002Flambda\u002Flatest\u002Fdg\u002Fconfiguration-envvars.html).\n\nYou are responsible for the remediation suggestions that you accept. Always review remediation suggestions before accepting them. You may need to make edits to remediation suggestions to ensure that your code does what you intended.\n\nReferences: \n\n1. https:\u002F\u002Fdocs.aws.amazon.com\u002Finspector\u002Flatest\u002Fuser\u002Fscanning-lambda.html\n2. https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fsecurity\u002Fhow-to-scan-your-aws-lambda-functions-with-amazon-inspector\u002F\n",[12],{"title":13,"collapsible":14,"isCollapsed":14,"content":15},"Governance in Depth",false,[16,29,37,46,53,61,66,73],{"title":17,"order":18,"authors":19,"callout":21,"time":25,"path":26,"id":27,"link":28},"1. Introduction",1,[20],"Heeki Park",{"title":22,"description":23,"link":24},"Watch this video","This reinvent 2023 video covers the topics of this guide in further detail.","https:\u002F\u002Fyoutu.be\u002Fqlz15v-gHFI","5 min","1-introduction","1-introduction.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002F1-introduction",{"title":30,"order":31,"authors":32,"time":33,"path":34,"id":35,"link":36},"2. Proactive Controls with AWS CloudFormation Guard",2,[20,9],"4 min","2-proactive-guard","2-proactive-guard.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002F2-proactive-guard",{"title":38,"order":39,"authors":40,"time":42,"path":43,"id":44,"link":45},"3. Proactive Controls with AWS Config",3,[41],"Debasis Rath","6 min","3-proactive-config","3-proactive-config.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002F3-proactive-config",{"title":47,"order":48,"authors":49,"time":25,"path":50,"id":51,"link":52},"4. Detective Controls with AWS Config",4,[41],"4-detective-config","4-detective-config.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002F4-detective-config",{"title":54,"order":55,"authors":56,"time":57,"path":58,"id":59,"link":60},"5. Code Signing with AWS Signer",5,[20],"3 min","5-code-signing","5-code-signing.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002F5-code-signing",{"title":6,"order":7,"authors":62,"time":57,"path":63,"id":64,"link":65},[9],"6-code-scanning","6-code-scanning.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002F6-code-scanning",{"title":67,"order":68,"authors":69,"time":42,"path":70,"id":71,"link":72},"7. Observability for Security and Compliance",7,[41],"7-observability","7-observability.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002F7-observability",{"title":74,"order":75,"authors":76,"time":77,"path":78,"id":79,"link":80},"8. Discussion of Open Source and other AWS tools",8,[20],"1 min","8-open-source-and-other-tools","8-open-source-and-other-tools.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002F8-open-source-and-other-tools","LIST",[83,84,85],"content\u002Fcontributors\u002Fheeki-park.json","content\u002Fcontributors\u002Fdebasis-rath.json","content\u002Fcontributors\u002Fpallavi-srivastava.json","Implementing governance in depth for serverless applications",1792578874341]