Skip to content

Commit 74e4efd

Browse files
sebstoSebastien Stormacq
sebsto
and
Sebastien Stormacq
authored
Apply recommendation for security and reliability (#573)
Apply recommendations in code and documentation - [CI] restrict permissions to read-all instead of the default write-all - All examples README.md : add a note about Lambda functions configuration with improved security and scalability changes for production environment - Swift docc documentation: add a note about Lambda functions configuration with improved security and scalability changes for production environment --------- Co-authored-by: Sebastien Stormacq <[email protected]>
1 parent d8aa38b commit 74e4efd

File tree

30 files changed

+359
-14
lines changed

30 files changed

+359
-14
lines changed

‎.github/workflows/integration_tests.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: IntegrationTests
22

3+
# As per Checkov CKV2_GHA_1
4+
permissions: read-all
5+
36
on:
47
workflow_call:
58
inputs:

‎.github/workflows/pull_request.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@ on:
44
pull_request:
55
types: [opened, reopened, synchronize]
66

7+
# As per Checkov CKV2_GHA_1
8+
permissions: read-all
9+
710
jobs:
811
soundness:
912
name: Soundness

‎Examples/APIGateway+LambdaAuthorizer/README.md‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,4 +109,14 @@ When done testing, you can delete the infrastructure with this command.
109109

110110
```bash
111111
sam delete --stack-name APIGatewayWithLambdaAuthorizer
112-
```
112+
```
113+
114+
## ⚠️ Security and Reliability Notice
115+
116+
These are example applications for demonstration purposes. When deploying such infrastructure in production environments, we strongly encourage you to follow these best practices for improved security and resiliency:
117+
118+
- Enable access logging on API Gateway ([documentation](https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html))
119+
- Ensure that AWS Lambda function is configured for function-level concurrent execution limit ([concurrency documentation](https://docs.aws.amazon.com/lambda/latest/dg/lambda-concurrency.html), [configuration guide](https://docs.aws.amazon.com/lambda/latest/dg/configuration-concurrency.html))
120+
- Check encryption settings for Lambda environment variables ([documentation](https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars-encryption.html))
121+
- Ensure that AWS Lambda function is configured for a Dead Letter Queue (DLQ) ([documentation](https://docs.aws.amazon.com/lambda/latest/dg/invocation-async-retain-records.html#invocation-dlq))
122+
- Ensure that AWS Lambda function is configured inside a VPC when it needs to access private resources ([documentation](https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html), [code example](https://github.com/swift-server/swift-aws-lambda-runtime/tree/main/Examples/ServiceLifecycle%2BPostgres))

‎Examples/APIGateway+LambdaAuthorizer/template.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,22 @@ AWSTemplateFormatVersion: '2010-09-09'
22
Transform: AWS::Serverless-2016-10-31
33
Description: SAM Template for APIGateway Lambda Example
44

5+
# This is an example SAM template for the purpose of this project.
6+
# When deploying such infrastructure in production environment,
7+
# we strongly encourage you to follow these best practices for improved security and resiliency
8+
# - Enable access loggin on API Gateway
9+
# See: https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html)
10+
# - Ensure that AWS Lambda function is configured for function-level concurrent execution limit
11+
# See: https://docs.aws.amazon.com/lambda/latest/dg/lambda-concurrency.html
12+
# https://docs.aws.amazon.com/lambda/latest/dg/configuration-concurrency.html
13+
# - Check encryption settings for Lambda environment variable
14+
# See: https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars-encryption.html
15+
# - Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)
16+
# See: https://docs.aws.amazon.com/lambda/latest/dg/invocation-async-retain-records.html#invocation-dlq
17+
# - Ensure that AWS Lambda function is configured inside a VPC when it needs to access private resources
18+
# See: https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html
19+
# Code Example: https://github.com/swift-server/swift-aws-lambda-runtime/tree/main/Examples/ServiceLifecycle%2BPostgres
20+
521
Resources:
622
# The API Gateway
723
MyProtectedApi:

‎Examples/APIGateway/README.md‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,4 +121,14 @@ When done testing, you can delete the infrastructure with this command.
121121

122122
```bash
123123
sam delete
124-
```
124+
```
125+
126+
## ⚠️ Security and Reliability Notice
127+
128+
These are example applications for demonstration purposes. When deploying such infrastructure in production environments, we strongly encourage you to follow these best practices for improved security and resiliency:
129+
130+
- Enable access logging on API Gateway ([documentation](https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html))
131+
- Ensure that AWS Lambda function is configured for function-level concurrent execution limit ([concurrency documentation](https://docs.aws.amazon.com/lambda/latest/dg/lambda-concurrency.html), [configuration guide](https://docs.aws.amazon.com/lambda/latest/dg/configuration-concurrency.html))
132+
- Check encryption settings for Lambda environment variables ([documentation](https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars-encryption.html))
133+
- Ensure that AWS Lambda function is configured for a Dead Letter Queue (DLQ) ([documentation](https://docs.aws.amazon.com/lambda/latest/dg/invocation-async-retain-records.html#invocation-dlq))
134+
- Ensure that AWS Lambda function is configured inside a VPC when it needs to access private resources ([documentation](https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html), [code example](https://github.com/swift-server/swift-aws-lambda-runtime/tree/main/Examples/ServiceLifecycle%2BPostgres))

‎Examples/APIGateway/template.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,22 @@ AWSTemplateFormatVersion: '2010-09-09'
22
Transform: AWS::Serverless-2016-10-31
33
Description: SAM Template for APIGateway Lambda Example
44

5+
# This is an example SAM template for the purpose of this project.
6+
# When deploying such infrastructure in production environment,
7+
# we strongly encourage you to follow these best practices for improved security and resiliency
8+
# - Enable access loggin on API Gateway
9+
# See: https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html)
10+
# - Ensure that AWS Lambda function is configured for function-level concurrent execution limit
11+
# See: https://docs.aws.amazon.com/lambda/latest/dg/lambda-concurrency.html
12+
# https://docs.aws.amazon.com/lambda/latest/dg/configuration-concurrency.html
13+
# - Check encryption settings for Lambda environment variable
14+
# See: https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars-encryption.html
15+
# - Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)
16+
# See: https://docs.aws.amazon.com/lambda/latest/dg/invocation-async-retain-records.html#invocation-dlq
17+
# - Ensure that AWS Lambda function is configured inside a VPC when it needs to access private resources
18+
# See: https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html
19+
# Code Example: https://github.com/swift-server/swift-aws-lambda-runtime/tree/main/Examples/ServiceLifecycle%2BPostgres
20+
521
Resources:
622
# Lambda function
723
APIGatewayLambda:

‎Examples/APIGatewayV1/README.md‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -139,4 +139,14 @@ When done testing, you can delete the infrastructure with this command.
139139

140140
```bash
141141
sam delete
142-
```
142+
```
143+
144+
## ⚠️ Security and Reliability Notice
145+
146+
These are example applications for demonstration purposes. When deploying such infrastructure in production environments, we strongly encourage you to follow these best practices for improved security and resiliency:
147+
148+
- Enable access logging on API Gateway ([documentation](https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html))
149+
- Ensure that AWS Lambda function is configured for function-level concurrent execution limit ([concurrency documentation](https://docs.aws.amazon.com/lambda/latest/dg/lambda-concurrency.html), [configuration guide](https://docs.aws.amazon.com/lambda/latest/dg/configuration-concurrency.html))
150+
- Check encryption settings for Lambda environment variables ([documentation](https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars-encryption.html))
151+
- Ensure that AWS Lambda function is configured for a Dead Letter Queue (DLQ) ([documentation](https://docs.aws.amazon.com/lambda/latest/dg/invocation-async-retain-records.html#invocation-dlq))
152+
- Ensure that AWS Lambda function is configured inside a VPC when it needs to access private resources ([documentation](https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html), [code example](https://github.com/swift-server/swift-aws-lambda-runtime/tree/main/Examples/ServiceLifecycle%2BPostgres))

‎Examples/APIGatewayV1/template.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,22 @@ AWSTemplateFormatVersion: '2010-09-09'
22
Transform: AWS::Serverless-2016-10-31
33
Description: SAM Template for APIGateway Lambda Example
44

5+
# This is an example SAM template for the purpose of this project.
6+
# When deploying such infrastructure in production environment,
7+
# we strongly encourage you to follow these best practices for improved security and resiliency
8+
# - Enable access loggin on API Gateway
9+
# See: https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html)
10+
# - Ensure that AWS Lambda function is configured for function-level concurrent execution limit
11+
# See: https://docs.aws.amazon.com/lambda/latest/dg/lambda-concurrency.html
12+
# https://docs.aws.amazon.com/lambda/latest/dg/configuration-concurrency.html
13+
# - Check encryption settings for Lambda environment variable
14+
# See: https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars-encryption.html
15+
# - Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)
16+
# See: https://docs.aws.amazon.com/lambda/latest/dg/invocation-async-retain-records.html#invocation-dlq
17+
# - Ensure that AWS Lambda function is configured inside a VPC when it needs to access private resources
18+
# See: https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html
19+
# Code Example: https://github.com/swift-server/swift-aws-lambda-runtime/tree/main/Examples/ServiceLifecycle%2BPostgres
20+
521
Resources:
622
# Lambda function
723
APIGatewayLambda:

‎Examples/BackgroundTasks/README.md‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -116,4 +116,14 @@ When done testing, you can delete the Lambda function with this command.
116116

117117
```bash
118118
aws lambda delete-function --function-name BackgroundTasks
119-
```
119+
```
120+
121+
## ⚠️ Security and Reliability Notice
122+
123+
These are example applications for demonstration purposes. When deploying such infrastructure in production environments, we strongly encourage you to follow these best practices for improved security and resiliency:
124+
125+
- Enable access logging on API Gateway ([documentation](https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html))
126+
- Ensure that AWS Lambda function is configured for function-level concurrent execution limit ([concurrency documentation](https://docs.aws.amazon.com/lambda/latest/dg/lambda-concurrency.html), [configuration guide](https://docs.aws.amazon.com/lambda/latest/dg/configuration-concurrency.html))
127+
- Check encryption settings for Lambda environment variables ([documentation](https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars-encryption.html))
128+
- Ensure that AWS Lambda function is configured for a Dead Letter Queue (DLQ) ([documentation](https://docs.aws.amazon.com/lambda/latest/dg/invocation-async-retain-records.html#invocation-dlq))
129+
- Ensure that AWS Lambda function is configured inside a VPC when it needs to access private resources ([documentation](https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html), [code example](https://github.com/swift-server/swift-aws-lambda-runtime/tree/main/Examples/ServiceLifecycle%2BPostgres))

‎Examples/CDK/README.md‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -118,4 +118,14 @@ Are you sure you want to delete: LambdaApiStack (y/n)? y
118118
LambdaApiStack: destroying... [1/1]
119119
... redacted for brevity ...
120120
✅ LambdaApiStack: destroyed
121-
```
121+
```
122+
123+
## ⚠️ Security and Reliability Notice
124+
125+
These are example applications for demonstration purposes. When deploying such infrastructure in production environments, we strongly encourage you to follow these best practices for improved security and resiliency:
126+
127+
- Enable access logging on API Gateway ([documentation](https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html))
128+
- Ensure that AWS Lambda function is configured for function-level concurrent execution limit ([concurrency documentation](https://docs.aws.amazon.com/lambda/latest/dg/lambda-concurrency.html), [configuration guide](https://docs.aws.amazon.com/lambda/latest/dg/configuration-concurrency.html))
129+
- Check encryption settings for Lambda environment variables ([documentation](https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars-encryption.html))
130+
- Ensure that AWS Lambda function is configured for a Dead Letter Queue (DLQ) ([documentation](https://docs.aws.amazon.com/lambda/latest/dg/invocation-async-retain-records.html#invocation-dlq))
131+
- Ensure that AWS Lambda function is configured inside a VPC when it needs to access private resources ([documentation](https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html), [code example](https://github.com/swift-server/swift-aws-lambda-runtime/tree/main/Examples/ServiceLifecycle%2BPostgres))

0 commit comments

Comments
 (0)