tarekcheikh/lambda-security-scanner repository overview

⁠lambda-security-scanner

A read-only AWS Lambda security and compliance scanner. It audits Lambda functions for runtime, environment-variable secrets, resource-based policies, function URLs, CORS, execution roles, VPC configuration, logging, code signing, and event source mappings, then maps every finding to 10 compliance frameworks.

Source, full documentation, and the required IAM policy: https://github.com/TocConsulting/lambda-security-scanner⁠

⁠Image tags

• latest, 1.0.0
• Multi-architecture: linux/amd64 and linux/arm64

⁠Quick start

Scan all functions with a mounted AWS profile and save reports to the host:

docker run --rm \
  -v ~/.aws:/root/.aws:ro \
  -v $(pwd)/output:/app/output \
  tarekcheikh/lambda-security-scanner:1.0.0 \
  security --profile default --region us-east-1

Scan with environment-variable credentials:

docker run --rm \
  -e AWS_ACCESS_KEY_ID \
  -e AWS_SECRET_ACCESS_KEY \
  -e AWS_SESSION_TOKEN \
  -v $(pwd)/output:/app/output \
  tarekcheikh/lambda-security-scanner:1.0.0 \
  security --region us-east-1

Scan specific functions:

docker run --rm \
  -v ~/.aws:/root/.aws:ro \
  -v $(pwd)/output:/app/output \
  tarekcheikh/lambda-security-scanner:1.0.0 \
  security -n my-function -n other-function

Compliance report only:

docker run --rm \
  -v ~/.aws:/root/.aws:ro \
  -v $(pwd)/output:/app/output \
  tarekcheikh/lambda-security-scanner:1.0.0 \
  security --compliance-only

Show help:

docker run --rm tarekcheikh/lambda-security-scanner:1.0.0 --help

⁠What it checks

19 checks across 5 categories:

• Function configuration: deprecated and end-of-life runtime detection, maximum timeout, environment-variable secret scanning, large ephemeral storage, external layers, X-Ray tracing, dead letter queue.
• Access control: public resource-based policy, function URL authentication, CORS wildcard origins, over-privileged execution roles, shared execution roles.
• Network security: VPC configuration, multi-AZ deployment, unrestricted security group egress.
• Logging and monitoring: CloudWatch log group and retention, reserved concurrency.
• Code and supply chain: code signing configuration, event source mapping failure destinations.

⁠Secret detection

Scans environment variables for plaintext credentials (AWS keys, GitHub and GitLab tokens, Stripe, Slack, private keys, connection strings, and more). Values that reference a managed secret store (a Secrets Manager, SSM, or KMS ARN, an SSM parameter path, or a CloudFormation dynamic reference) are the recommended pattern and are treated as clean, not as a leaked secret.

⁠Compliance frameworks

AWS FSBP, CIS AWS Compute Services Benchmark, PCI DSS v4.0.1, HIPAA Security Rule, SOC 2, ISO 27001:2022, ISO 27017:2015, ISO 27018:2019, GDPR, and NIST SP 800-53 Rev5. Findings map to 81 controls in total.

⁠Reports

JSON, CSV, and interactive HTML output, plus a dedicated per-function compliance report. Reports are written to /app/output inside the container, so mount a host directory there to keep them.

⁠Credentials

Provide AWS credentials by mounting ~/.aws to /root/.aws or by passing AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and optionally AWS_SESSION_TOKEN as environment variables. The scanner needs only read-only describe and get permissions; the complete IAM policy is in the GitHub README.

⁠Safety

The scanner is strictly read-only and does not modify any AWS resource. Permission errors are reported as findings rather than producing a falsely clean report.

⁠License

MIT