US 12,744,818 B2 · Identifying serverless functions with over-permissive roles

Abstract

Based on analyzing a serverless function associated with a first role, a set of security permissions granted to the serverless function is identified based on the first role and a first attribute of the serverless function. A least privilege role indicating a set of least privilege security permissions for the serverless function is generated based, at least in part, on the first attribute. Based on comparing the least privilege role with the first role, it is determined if the set of security permissions granted to the serverless function is more permissive than the set of least privilege security permissions. Based on determining that the set of security permissions granted to the serverless function is more permissive than the set of least privilege security permissions, the first role is reported as over-permissive.

Claims20

Dependent claims

A method comprising:

analyzing one or more serverless functions for at least one of vulnerabilities and insecure configurations, wherein analyzing the one or more serverless functions comprises,
based on receiving a request to scan the one or more serverless functions, scanning the one or more serverless functions for at least one of vulnerabilities and insecure configurations and scanning one or more resources related to the one or more serverless functions for misconfigurations;
detecting at least one of a vulnerability and an insecure configuration in at least one of a first of the one or more serverless functions and in a first of the one or more resources related to the one or more serverless functions based on scanning the one or more serverless functions and the one or more resources;
and
reporting the at least one of the vulnerability and the insecure configuration in the first serverless function and/or the misconfiguration in the first resource.

2 more elements

One or more non-transitory machine-readable media having program code for analyzing a serverless function stored thereon, the program code comprising instructions to:

based on receipt of a request that indicates the serverless function, scan the serverless function and one or more resources related to the serverless function, wherein the instructions to scan the serverless function comprise instructions to scan the serverless function to detect at least one of vulnerabilities and insecure configurations of the serverless function, wherein the instructions to scan the one or more resources related to the serverless function comprise instructions to scan the one or more resources to detect misconfigurations of the one or more resources;
detect at least one of a vulnerability and an insecure configuration of the serverless function and/or a misconfiguration of a first of the one or more resources based on the scan of the serverless function and the scan of the one or more resources;
and
report the at least one of the vulnerability and the insecure configuration of the serverless function and/or the misconfiguration of the first resource related to the serverless function.

1 more element

An apparatus comprising:

a processor;
and
a machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to,
based on receipt of a request to scan one or more serverless functions, scan the one or more serverless functions for at least one of vulnerabilities and insecure configurations and scan one or more resources related to the one or more serverless functions for misconfigurations;
detect at least one of a vulnerability and an insecure configuration of a first serverless function of the one or more serverless functions and/or a misconfiguration of a first of the one or more resources related to the one or more serverless functions based on the scan of the one or more serverless functions and the scan of the one or more resources;
and
report the at least one of the vulnerability and the insecure configuration of the first serverless function and/or the misconfiguration of the first resource.

4 more elements

Dependencies are inferred from the claim text.

Identifying serverless functions with over-permissive roles

Life of this patent

Identifying serverless functions with over-permissive roles

Life of this patent

Abstract

Claims20