skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-serverless-function-security-review

Reviews serverless functions across AWS Lambda, Azure Functions, and GCP Cloud Functions for security misconfigurations.

954|172|Updated Mar 13, 2026
Search Tags:#secrets detection#checkov#prowler#AWS Lambda#serverless security#iam audit#cloud security review
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-serverless-function-security-review
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-serverless-function-security-review
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/cloud-security/performing-serverless-function-security-review
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-serverless-function-security-review

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Serverless functions often ship with overly permissive execution roles, plaintext secrets in environment variables, deprecated runtimes, and publicly invocable endpoints that are easy to miss during manual audits. This Skill provides a structured review workflow to systematically identify and confirm these risks before they become incidents.

Core Features & Use Cases

  • Execution Role Auditing: Resolve effective IAM permissions across inline and managed policies to detect wildcard actions and over-privileged roles.
  • Secrets and Exposure Detection: Scan environment variables, deployment packages, and layers for hardcoded credentials, and check Function URLs, resource-based policies, and API Gateway authorizers for public access.
  • Code and Runtime Analysis: Grep function code for injection and deserialization patterns, flag deprecated runtimes, and run Checkov and Prowler for automated compliance checks.
  • Use Case: Before a production deployment, run the review across all Lambda functions to find one function with an AdministratorAccess role and Stripe keys in plaintext env vars, then remediate with a scoped policy and Secrets Manager migration.

Quick Start

Review all serverless functions in my AWS account for over-privileged execution roles, exposed secrets, and public invocation paths, and produce a findings report.

Frequently Asked Questions about performing-serverless-function-security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit AWS Lambda execution roles for excessive permissions?▼

List each function's execution role, enumerate attached and inline policies, and check for wildcard actions or resources. Use aws iam simulate-principal-policy to confirm a suspicious action is actually allowed rather than relying on policy inspection alone.

How to find secrets in Lambda environment variables?▼

Retrieve environment variables with aws lambda get-function-configuration and pattern-match keys and values against terms like password, secret, token, and AKIA access key prefixes. Also scan the deployment package and layers, since credentials are often committed in .env or config files.

What tools scan serverless functions for security issues?▼

Prowler provides Lambda-specific checks for secrets in variables, Function URL auth types, supported runtimes, and public access. Checkov scans Serverless Framework and infrastructure-as-code templates, while Bandit handles static analysis of Python function code.

Can a Lambda function be publicly accessible without a Function URL?▼

Yes. A resource-based policy with Principal set to * on lambda:InvokeFunction allows public invocation independent of Function URLs. API Gateway authorizers set to NONE create a third exposure path, so all three must be checked.

When should I not use a serverless security review workflow?▼

Do not use it for container or VM security assessments, which need container scanning tools, or for API security testing, which belongs to DAST tools at the API Gateway layer. Real-time threat detection requires Lambda Extensions with security agents instead.

Related Skills

Explore More Software Engineering Skills→
SkobynSkobyn

cloud-iam-deep

Enumerate IAM roles, policies, and users across AWS, Azure, and GCP.

Community
Advanced
aurainfosecaurainfosec

secrets-manager

Store, retrieve, and rotate application credentials in AWS Secrets Manager.

Official
Intermediate
balsm-healthbalsm-health
2

detecting-s3-data-exfiltration-attempts

Detect AWS S3 data exfiltration attempts by analyzing CloudTrail logs.

Official
Advanced
Muath2000Muath2000

network-scanner-engineer

Build and manage network scanning engines for asset discovery and vulnerability detection.

Community
Advanced