No project description provided
Project description
# FunctionShield
> AWS Lambda Security Library for Developers. Regain Control over Your Serverless Runtime.
## How FunctionShield helps With AWS Lambda Security?
* By monitoring (or blocking) outbound network traffic from your function, you can be certain that your data is never leaked
* By disabling read/write operations on the /tmp/ directory, you can make your function truly ephemeral
* By disabling the ability to launch child processes, you can make sure that no rogue processes are spawned without your knowledge by potentially malicious packages
* By disabling the ability to read the function's (handler) source code through the file system, you can prevent handler source code leakage, which is oftentimes the first step in a serverless attack
## Get a free token
Please visit: https://www.puresec.io/function-shield-token-form
## Install
```sh
$ pip install function-shield
```
## Super simple to use
```python
import function_shield
function_shield.configure({
"policy": {
# 'block' mode => active blocking
# 'alert' mode => log only
# 'allow' mode => allowed, implicitly occurs if key does not exist
"outbound_connectivity": "block",
"read_write_tmp": "block",
"create_child_process": "block",
"read_handler": "block"
},
"token": os.environ['FUNCTION_SHIELD_TOKEN']
})
def handler(event, context):
# Your Code Here #
```
## Logging & Security Visibility
FunctionShield logs are sent directly to your function's AWS CloudWatch log group.
Here are a few sample logs, demonstrating the log format you should expect:
```js
// Log example #1:
{
"function_shield": true,
"policy": "outbound_connectivity",
"details": {
"host": "google.com"
},
"mode": "alert"
}
// Log example #2:
{
"function_shield": true,
"policy": "read_write_tmp",
"details": {
"path": "/tmp/node-alert"
},
"mode": "alert"
}
// Log example #3:
{
"function_shield": true,
"policy": "create_child_process",
"details": {
"path": "/bin/sh"
},
"mode": "block"
}
// Log example #4:
{
"function_shield": true,
"policy": "read_handler",
"details": {
"path": "/var/task/handler.js"
},
"mode": "alert"
}
```
## Custom Security Policy (whitelisting)
Custom security policy is only supported with the PureSec SSRE full product.
[Get PureSec](https://www.puresec.io/product)
> AWS Lambda Security Library for Developers. Regain Control over Your Serverless Runtime.
## How FunctionShield helps With AWS Lambda Security?
* By monitoring (or blocking) outbound network traffic from your function, you can be certain that your data is never leaked
* By disabling read/write operations on the /tmp/ directory, you can make your function truly ephemeral
* By disabling the ability to launch child processes, you can make sure that no rogue processes are spawned without your knowledge by potentially malicious packages
* By disabling the ability to read the function's (handler) source code through the file system, you can prevent handler source code leakage, which is oftentimes the first step in a serverless attack
## Get a free token
Please visit: https://www.puresec.io/function-shield-token-form
## Install
```sh
$ pip install function-shield
```
## Super simple to use
```python
import function_shield
function_shield.configure({
"policy": {
# 'block' mode => active blocking
# 'alert' mode => log only
# 'allow' mode => allowed, implicitly occurs if key does not exist
"outbound_connectivity": "block",
"read_write_tmp": "block",
"create_child_process": "block",
"read_handler": "block"
},
"token": os.environ['FUNCTION_SHIELD_TOKEN']
})
def handler(event, context):
# Your Code Here #
```
## Logging & Security Visibility
FunctionShield logs are sent directly to your function's AWS CloudWatch log group.
Here are a few sample logs, demonstrating the log format you should expect:
```js
// Log example #1:
{
"function_shield": true,
"policy": "outbound_connectivity",
"details": {
"host": "google.com"
},
"mode": "alert"
}
// Log example #2:
{
"function_shield": true,
"policy": "read_write_tmp",
"details": {
"path": "/tmp/node-alert"
},
"mode": "alert"
}
// Log example #3:
{
"function_shield": true,
"policy": "create_child_process",
"details": {
"path": "/bin/sh"
},
"mode": "block"
}
// Log example #4:
{
"function_shield": true,
"policy": "read_handler",
"details": {
"path": "/var/task/handler.js"
},
"mode": "alert"
}
```
## Custom Security Policy (whitelisting)
Custom security policy is only supported with the PureSec SSRE full product.
[Get PureSec](https://www.puresec.io/product)
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distributions
No source distribution files available for this release.See tutorial on generating distribution archives.
Built Distributions
Close
Hashes for function_shield-1.1.2-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | d2df0af0fa3acf2246eab1c14d6f53621cdf5c1901190fbdc789860bfe5ee99e |
|
MD5 | eaa8244c3087653b374bef00ff1ee345 |
|
BLAKE2b-256 | e01cb820a34fc7f8b60b65df58d6f9d1f5e3d5266a35957da15dc8cde7eb8cb3 |
Close
Hashes for function_shield-1.1.2-py2-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | c5b688a1a21c3261f1b570f50c92a1ae3e74e99647109ca271c0586617b45b40 |
|
MD5 | 8a877dc176d2a80e012a5125833bd007 |
|
BLAKE2b-256 | e65c3f133fe14f94a0b5f40c48a085c28f9dc950d83ff4d000e17a2a832f9d8f |