Identifying serverless functions with over-permissive roles

A non-transitory computer-readable medium having instructions stored thereon, the instructions executable by a processor to perform operations comprising:

• based on analyzing a serverless function for which a first role is defined, identifying actual security permissions that the first role grants to the serverless function for access to a first resource;
• generating a least privilege role for the serverless function that grants least privilege security permissions for access to the first resource based, at least in part, on a first attribute of the serverless function, wherein the least privilege security permissions comprise a set of minimal permissions for access to the first resource by the serverless function;
• determining whether the actual security permissions granted to the serverless function by the first role are more permissive than the least privilege security permissions based, at least in part, on comparing the least privilege security permissions with the actual security permissions;
• and
• based on determining that the actual security permissions granted to the serverless function are more permissive than the least privilege security permissions, reporting that the first role defined for the serverless function is over-permissive relative to the least privilege security permissions and performing a mitigation action for the serverless function.

A system comprising:

• a processor;
• a computer-readable medium having instructions stored thereon that are executable by the processor to cause the system to,
• based on analysis a serverless function for which a first role is defined, identify actual security permissions that the first role grants to the serverless function for access to a first resource;
• generate a least privilege role for the serverless function that grants least privilege security permissions for access to the first resource based, at least in part, on a first attribute of the serverless function, wherein the least privilege security permissions comprise a set of minimal permissions for access to the first resource by the serverless function;
• determine if the actual security permissions granted to the serverless function by the first role are less strict than the least privilege security permissions granted by the least privilege role based, at least in part, on comparison of the least privilege security permissions with the actual security permissions;
• and
• based on a determination that the actual security permissions granted to the serverless function are less strict than the least privilege security permissions, report that the first role defined for the serverless function is over-permissive relative to the least privilege security permissions and perform a mitigation action for the serverless function.