OWASP Serverless Top 10
This skill encodes the OWASP Top 10 Serverless Interpretation for secure serverless design and review. References are loaded per risk. Based on OWASP Top 10 Serverless Interpretation 2018. See the official PDF for the exact 10 categories.
When to Read Which Reference
| Risk | Read |
|---|---|
| SL1 Injection (Serverless) | references/sl01-injection.md |
| SL2 Broken Authentication (Serverless) | references/sl02-broken-auth.md |
| SL3 Sensitive Data Exposure (Serverless) | references/sl03-sensitive-data-exposure.md |
| SL4 XML External Entities (Serverless) | references/sl04-xxe.md |
| SL5 Broken Access Control (Serverless) | references/sl05-broken-access-control.md |
| SL6 Security Misconfiguration (Serverless) | references/sl06-misconfiguration.md |
| SL7 XSS (Serverless) | references/sl07-xss.md |
| SL8 Insecure Deserialization (Serverless) | references/sl08-insecure-deserialization.md |
| SL9 Using Components with Known Vulnerabilities (Serverless) | references/sl09-vulnerable-components.md |
| SL10 Insufficient Logging and Monitoring (Serverless) | references/sl10-logging-monitoring.md |
Quick Patterns
- Validate and sanitize event input (injection); use least privilege for function IAM; avoid hardcoded secrets; secure config and dependencies; enable logging and monitoring.
Quick Reference / Examples
| Task | Approach |
|---|---|
| Prevent event injection | Validate/sanitize all event data (API Gateway, S3, SNS). See SL1. |
| Least privilege IAM | Scope function roles to exact resources needed. See SL5. |
| Manage secrets | Use Secrets Manager/Parameter Store, not env vars. See SL3. |
| Secure dependencies | Pin versions, scan for vulnerabilities. See SL9. |
| Enable logging | CloudWatch/X-Ray for all functions. See SL10. |
Safe - input validation in Lambda:
import json
def handler(event, context):
body = json.loads(event.get("body", "{}"))
user_id = body.get("user_id", "")
if not user_id.isalnum() or len(user_id) > 36:
return {"statusCode": 400, "body": "Invalid user_id"}
# Proceed with validated input
Safe - least privilege IAM policy:
# serverless.yml
provider:
iam:
role:
statements:
- Effect: Allow
Action: dynamodb:GetItem
Resource: arn:aws:dynamodb:*:*:table/users
Unsafe - overly permissive IAM:
# NEVER do this
statements:
- Effect: Allow
Action: "*"
Resource: "*"
Workflow
Load the reference for the risk you are addressing. Confirm exact risk names from the official OWASP Serverless Top 10 PDF.