Find vulnerabilities on Inspector2 using Lambda scanning

​

Overview

​

Lab Details

1. The lab involves creating an inspector and lambda function
2. Trigging the lambda function to scan the inspector to finding the vulnerabilities
3. Duration: 1 hour
4. AWS Region: US East (N. Virginia) us-east-1

​

Introduction

1. Amazon Inspector is a service provided by Amazon Web Services (AWS) that helps you to automatically assess the security and compliance of your AWS resources, including AWS Lambda functions.
2. It performs security assessments by analyzing your resources and identifying potential vulnerabilities and deviations from best practices.
3. Learn how to navigate the Amazon Inspector console to view detailed findings of scanned Lambda functions, including CVE identifiers and severity ratings.
4. Inspector v2 integrates seamlessly with AWS services such as EC2, ECR, and Lambda, allowing for continuous vulnerability assessment and management.
5. In this lab, you will learn how to scan your AWS Lambda functions using Amazon Inspector

​

Architecture Diagram

​

Task Details

1. Sign in to AWS Management Console
2. Creating an inspector2 and activating it
3. Creating a lambda function and the layers
4. Triggering the lambda function
5. Scanning the lambda function to check the vulnerabilities

​

Launching Lab Environment

1. To Launch the lab Environment, Click On The Start Lab Button.
2. Please Wait Until The Cloud Environment Is Provisioned. It Will Take Less Than A Minute To Provision.
3. Once The lab Is Started, You Will Be Provided With IAM User Name, Password, Access Key, And Secret Access Key.

Note : You can only start one guided lab at any given time

​

Lab guide

​

Lab Steps

​

Task 1: Sign in to AWS Management Console

1. Click On The Open Console Button, And You Will Get Redirected To AWS Console In A New Browser Tab.
2. On The AWS Sign-In Page, Leave The Account ID As Default. Never Edit/Remove The 12 Digit Account ID Present In The AWS Console. Otherwise, You Cannot Proceed With The Lab.
3. Now Copy Your User Name And Password In The Lab Console To The IAM Username And Password In AWS Console And Click On The Sign In Button.
4. Once Signed In To The AWS Management Console, Make The Default AWS Region As US East (N. Virginia) Us-East-1.

​

Task 2: Enable Amazon Inspector for your AWS Account

1. In the AWS console, search for Amazon Inspector and click on it.
2. Click on Get started.

3. And you will be able to see Activate Inspector.
4. Click on the Activate Inspector

5. In the left-side dashboard, scroll down and click on Account management.
6. Click on the Activate button.
7. Check AWS Lambda Standard scanning.

• Lambda standard scanning — With this option enabled, Amazon Inspector only scans for package dependencies in your Lambda functions and associated layers.

8. Click on Submit.

​

Task 3: Create a Lambda Function

1. Make sure you are in the US East (N. Virginia) region.
2. Go to the Services menu and click on Lambda under Compute section.
3. Click on the Create a function button.
4. Choose Author from scratch

• Function name : testing_lambda
• Runtime : Select Python 3.11

5. Expand Change default execution role select use an existing role and select Lambda_role from the drop-down.

6. Click on the Create function button.
7. If you scroll down a little bit, you can see the Code source section. Here we are going to replace the python function code.
8. Remove the existing code in AWS lambda_function.py. Copy the below code and paste it into your lambda_function.py file.

import json
import os
import paramiko

def lambda_handler(event, context):
    print("Hello world")
    os.system("ssh -h")

9. click on Deploy button.

​

Task 4: Creating Layers for Lambda function

1. In the Lambda console, click on the Layers section in the left-hand navigation pane
2. Click on the Create Layer button.

3. Layer name: paramiko_layer
4. Description: Creating a paramiko layer for the lambda function
5. Click on the below link to download the zip file to upload in the layers.

• Paramiko_layer

6. Compatible architectures: x86_64
7. Runtime: python 3.11

8. Click on the Create button.

​

Task 5:  Adding the layers to the lambda function

1. In the Lambda console, click on the function you created earlier.
2. In the Code section, scroll down to the Layers section.
3. Click on the Add Layer button.

4. Go to the Custom Layers section.
5. Under the custom layers dropdown, choose the Paramiko layer you created earlier.
6. Click on the version dropdown and select the appropriate version.

7. Click the Add button.
8. After creating the layer scroll it will look like these.

9. Now, go back to your Lambda function and click the Test button and click Create new test event.

10. Enter the name as lambda_test and click Save.

11. Now click Invoke button. It will trigger the Inspector Lambda scanning.

​

Task 6: Finding the vulnerability for the Lambda function

1. Go back to the Inspector console.
2. Scroll down and click on Resources coverage from the left panel.
3. Click on the Lambda functions to see the status of the scanning.

4. Now click Findings from the left panel and click By Lambda function.

5. Click on the testing_lambda and scroll down, you will be able to see the different CVE names.

6. Click on any CVE title to see the findings details.

7. Scroll down CVE tab to see more details.
8. In Vulnerability details click on the Vulnerability ID to see the National vulnerability database.

• Government Repository: Managed by the U.S. National Institute of Standards and Technology (NIST).
• Vulnerability Information: Contains detailed data on known software vulnerabilities.
• CVE Identifiers: Uses Common Vulnerabilities and Exposures (CVE) identifiers for each vulnerability.
• Severity Ratings: Provides severity scores using the Common Vulnerability Scoring System (CVSS).
• Impact Analysis: Describes potential impacts on confidentiality, integrity, and availability.
• Remediation Guidance: Offers recommendations for fixing or mitigating vulnerabilities.
• Search Tools: Includes tools for searching and analyzing vulnerabilities.

Do you know? Amazon Inspector for Lambda functions provides advanced security features, including dependency vulnerability scanning, Lambda layer analysis, and environment variable inspection. It enforces least privilege, checks runtime policies for compliance, and evaluates network accessibility to prevent public exposure. Inspector also maps findings to compliance frameworks like PCI-DSS, HIPAA, and GDPR, ensuring regulatory adherence for serverless applications.

​

Completion and Conclusion

1. You Have Successfully logged into AWS console.
2. You Have Successfully created inspector2.
3. You Have Successfully created lambda.
4. You Have Successfully triggered the lambda scanning.
5. You Have Successfully found the vulnerability using lambda scanning.

​

End Lab

1. Sign Out Of AWS Account.
2. You Have Successfully Completed The Lab.
3. Once You Have Completed The Steps, Click On End Lab From Your IP Lab Portal And Wait Till The Process Gets Completed.

​

What gets checked

• Create an AWS Lambda Function — Check whether a Lambda Function is created or not
• Check Lambda Findings in InspectorV2 — Check whether lambda findings are present or not

​

Related help

• FAQs and Troubleshooting