Scanning Amazon Lambda functions with Amazon Inspector
Amazon Inspector support for Amazon Lambda functions and layers provides continuous automated security vulnerability assessments. Amazon Inspector offers two types of Lambda function scanning:
Amazon Inspector Lambda standard scanning
This is the default Lambda scan type. Lambda standard scanning scans application dependencies within a Lambda function and layers for package vulnerabilities.
Amazon Inspector Lambda code scanning
This scan type scans the custom application code in your Lambda function and layers for code vulnerabilities. You can either activate Lambda standard scanning or activate Lambda standard scanning with Lambda code scanning..
When you activate Lambda function scanning, Amazon Inspector creates the following Amazon CloudTrail service-linked channels in your account: cloudtrail:CreateServiceLinkedChannel and cloudtrail:DeleteServiceLinkedChannel.
Amazon Inspector manages these channels and uses them to monitor your CloudTrail events for scans.
These channels allow you to see CloudTrail events in your account as if you had a trail in CloudTrail.
We recommend you create your own trail in CloudTrail to manage events for your account.
For information about how to activate Lambda function scanning, see Activating a scan type. This section provides information about Lambda function scanning.
Scan behaviors for Lambda function scanning
Upon activation, Amazon Inspector scans all Lambda functions invoked or updated in the last 90 days in your account. Amazon Inspector initiates vulnerability scans of Lambda functions in the following situations:
-
As soon as Amazon Inspector discovers an existing Lambda function.
-
When you deploy a new Lambda function to the Lambda service.
-
When you deploy an update to the application code or dependencies of an existing Lambda function or its layers.
-
Whenever Amazon Inspector adds a new common vulnerabilities and exposures (CVE) item to its database, and that CVE is relevant to your function.
Amazon Inspector monitors each Lambda function throughout its lifetime until it's either deleted or excluded from scanning.
You can check when a Lambda function was last checked for vulnerabilities from the Lambda functions tab on the Account management page, or by using the ListCoverage API. Amazon Inspector updates the Last scanned at field for a Lambda function in response to the following events:
-
When Amazon Inspector completes an initial scan of a Lambda function.
-
When a Lambda function is updated.
-
When Amazon Inspector re-scans a Lambda function because a new CVE item impacting that function was added to the Amazon Inspector database.
Supported runtimes and eligible functions
Amazon Inspector supports different runtimes for Lambda standard scanning and Lambda code scanning. For a list of supported runtimes for each scan type, see Supported runtimes: Amazon Inspector Lambda standard scanning and Supported runtimes: Amazon Inspector Lambda code scanning.
In addition to having a supported runtime, a Lambda function needs to meet the following criteria to be eligible for Amazon Inspector scans:
-
The function has been invoked or updated in the last 90 days.
-
The function is marked
$LATEST. -
The function isn't excluded from scans by tags.
Note
Lambda functions that haven't been invoked or modified in the last 90 days are automatically excluded from scans. Amazon Inspector will resume scanning an automatically excluded function if it is invoked again or if changes are made to the Lambda function code.