Serverless Over-Privilege
A function is a principal. An admin role, secrets in environment variables and a public URL compound into a short path from the internet to everything. Close all three and prove the unauthenticated invoke is refused.
What Is Serverless Over-Privilege?
A function is a principal. Giving something that resizes images an administrative role, leaving its secrets in environment variables and its URL open to anyone, is three failures that compound into one very short path from the internet to everything. This exercise covers that path and closes each part of it.
What You'll Learn in Serverless Over-Privilege
- A function is a principal, and its credentials are ambient, so code execution in the function is immediate access to its role.
- Secrets in environment variables are exposed to anyone who can read the function configuration, and they surface in diagnostics.
- An unauthenticated function URL turns an internal misconfiguration into an internet-reachable one.
- Scoping the role matters most, because it bounds the damage when the other two controls fail.
Serverless Over-Privilege — Training Steps
-
Start where everyone can look
Bob is not inside Vaelrick. He is on their public property-listings site, the same page any buyer sees. There is nothing privileged here - which is exactly why it is where he starts.
-
Watch what the page asks for
Bob opens the browser's network panel and reloads the page, so he can see the requests the gallery makes before any image appears.
-
It answers anyone
Bob calls the endpoint directly from his own machine, with no credentials at all.
-
The debug flag dumps its identity
Bob adds the debug parameter the site told him about. The function prints its whole environment.
-
Put on the function's identity
The three AWS_ values from the dump are a complete, working set of temporary credentials. Bob loads them into a named profile on his own machine, and from that moment his CLI can act as the function.
-
Become the function
The profile is loaded. Bob asks AWS the first question any attacker asks with a fresh set of credentials: who am I now?
-
How far does a thumbnail maker reach?
A function that writes thumbnails should see one bucket. Bob asks for all of them.
-
Take the crown jewels
Bob uses the role to read a secret that has nothing whatsoever to do with resizing images.
-
Which failure did the damage?
Before the response, name what turned a leaked endpoint into a production breach.
-
Someone is using our Stripe key
Vaelrick's payment processor flagged API calls signed with their live key from an unfamiliar address. That key lives in Secrets Manager, which is supposed to be the safe place for it.