How to limit requests made from lambda? For example, I want to set that only the specified domain name can be requested in lambda

0

How to limit requests from lambda? For example, I want to set that only the specified domain name can be requested in lambda Because my lambda function will dynamically execute the user's code, I think there is a security risk here, so I want to limit the requests initiated from the lambda to ensure the security of the data, or is there a better solution? thanks~

zale
已提問 2 年前檢視次數 527 次
2 個答案
1
已接受的答案

First: Dynamically executing code submitted by users is a massive security risk. So think very carefully before you do that.

Given that the Lambda function is your code the easiest way to do this is to have a list of domains that are allowed to be connected to and parse the user code so that only those domains are allowed. That's not actually "easy" but it's probably the best solution.

If your Lambda function is not connected to a VPC then there is no way to filter the traffic from it. But if it is connected to a VPC then you could send traffic from the Lambda function via a firewall of some sort. However, in today's world most traffic is going to be encrypted; you can filter based on the SNI in the HTTPS connection header but doing this introduces a bunch of costs - firewalls, NAT Gateways, etc. So it's less expensive to go with the first option - parse the code.

profile pictureAWS
專家
已回答 2 年前
1

First, Lambda doesn't have ways to limit the outbound traffic. You may be able to do that by attaching the functions to a VPC and then routing all traffic via some proxy that checks and limits the communication.

Saying that, and given that the you want to run your customer's code, there is an option to use deno. Deno is a secure runtime for JavaScript and TypeScript. When you invoke deno, you can specify which destinations it can communicate with. Using this approach your Lambda function will download your users' code and invoke deno as a separate processes, with the allowed list of destinations. You can also create a custom deno run-time instead.

profile pictureAWS
專家
Uri
已回答 2 年前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南