Twistlock Serverless Defenders protect serverless functions at runtime. Currently, Twistlock supports AWS Lambda functions.
Lambda layers are ZIP archives that contain libraries, custom runtimes, or other dependencies. Layers let you add reusable components to your functions, and focus deployment packages on business logic. They are extracted to the /opt directory in the function execution environment. For more information, see the AWS Lambda layers documentation.
Twistlock delivers Serverless Defender as a Lambda layer. Invoke Serverless Defender in your function with a simple import statement, and provide the policy as a base64 string in the TW_POLICY environment variable.
To secure an AWS Lambda function with the Serverless Defender layer:
Download the Serverless Defender Lambda layer ZIP file.
Upload the layer to AWS.
Add the layer to your function, and invoke the Serverless Defender from your function.
Define your policy.
Download the Serverless Defender layer from Twistlock Console.
Open Console, then go to Manage > Defenders > Deploy.
Choose the DNS name or IP address that Serverless Defender uses to connect to Console.
Set the Defender type to Serverless.
For Deployment Type, select Layer.
Click Download Twistlock Layer. A ZIP file is downloaded to your host.
Add the layer to the AWS Lambda service as a resource available to all functions.
In the AWS Management Console, go to the Lambda service.
Click Layers.
In Name, enter twistlock.
Click Upload, and select the file you just downloaded, twistlock_defender_layer.zip
Select the compatible runtimes: Python 3.6 or Node.js 8.10.
Click Create.
Embed the Serverless Defender as a layer, and run it when your function is invoked.
You already have a Lambda function.
Your Lambda function is written for the Node.js 8.10 or Python 3.6 runtime.
Your function’s execution role grants it permission to write to CloudWatch Logs. Note that the AWSLambdaBasicExecutionRole grants permission to write to CloudWatch Logs.
Go to the function designer in the AWS Management Console.
Click on the Layers icon.
In the Referenced Layers panel, click Add a layer.
In the Select from list of runtime compatible layers, select twistlock.
In the Version drop-down list, select 1.
Click Add.
When you return to the function designer, you’ll see that your function now uses one layer.
Import the Twistlock layer into your function by adding the appropriate line to your code depending on your runtime.
If your runtime is Python 3.6, enter the following code on line 1 of your function code:
import twistlock
If your runtime is Node.js 8.10, enter the following code on line 1 of your function code:
const twistlock = require('twistlock');
Click Save to preserve all your changes.
Policies are defined in Twistlock Console, and then injected into your functions as an environment variables. Create a new rule in Twistlock Console, then add it to your function definition.
The policy defined in this procedure shows you how to secure your function against command injection.
Create a new rule in Twistlock Console that prevents all processes, besides the main process, from running.
By default, new rules apply to all functions (*
), but you can target them to specific functions using pattern matching.
Policy violation audits can be reviewed in CloudWatch Logs and Twistlock Console.
Log into Twistlock Console.
Go to Defend > Runtime > Serverless Policy.
Click Add rule.
In the General tab, enter a rule name.
Click the Processes tab.
Set Effect to Prevent.
Click Save.
Get a copy of the policy.
In the Actions menu for the rule you just created, click Copy as Text.
Go to the function designer in the AWS Management Console.
In the Environment variables panel:
For Key, enter TW_POLICY.
For Value, paste the rule you copied from Twistlock Console.
Click Save.
Audits for policy violations can be found in CloudWatch Logs and Twistlock Console.
To view audits in CloudWatch logs, click Monitoring, then click View logs in CloudWatch.
To view audits in Twistlock Console, go to Monitor > Events > Serverless Audits.