AWS Lambda Scanning — Overview
Qualys Container Security discovers and scans AWS Lambda functions to identify vulnerabilities in deployed function code, container images, and associated layers. Lambda scanning runs automatically whenever a function is created, updated, or deleted, and performs an initial backfill scan of all existing functions when a new account is onboarded.
AWS Lambda is a serverless compute service that lets you run code without provisioning or managing servers. While Lambda simplifies operations and improves scalability, it introduces unique security challenges: dependency vulnerabilities in packaged code, misconfigurations in function permissions, and risks from unscanned container images used as function runtimes.
Qualys Lambda scanning gives you continuous visibility into these risks across all onboarded AWS accounts and regions from a single place in the Qualys Enterprise TruRisk™ Platform.
How Lambda Scanning Works
Lambda scanning uses an event-driven architecture deployed entirely in your AWS environment. All scanning runs inside a designated service account; target accounts contain no scanning infrastructure.
- Real-time detection: AWS CloudTrail captures Lambda lifecycle events (CreateFunction, UpdateFunctionCode, DeleteFunction). An EventBridge rule matches these events and delivers them to an SQS queue in the service account, where the qualys-cloud-operator Lambda function processes them immediately.
- Initial backfill: When a new target account is onboarded, all existing Lambda functions in that account are automatically discovered and enqueued for scanning — no manual trigger is needed.
- Cross-account scanning: The service account assumes a read-only cross-account IAM role (QualysCloudOperatorRole) in each target account to download function code or container images, scan them, and upload results to the Qualys platform. Nothing in the target account is modified.
- Multi-region coverage: Secondary regions are handled via CloudFormation StackSets. EventBridge forwarding rules are deployed automatically in each listed region — no separate stack deployment is required per region.
- Deduplication: Atomic conditional writes in DynamoDB prevent redundant scans for the same Lambda function ARN.
- Dead-letter queue handling: Scan requests that fail after 10 retry attempts are moved to a dead-letter queue for administrator investigation.
What Lambda Scanning Covers
For each discovered Lambda function, Qualys scans the following.
| Scan Target | Description |
|---|---|
| Function code packages | ZIP-based deployment packages are downloaded and scanned for vulnerable dependencies and libraries. |
| Container image runtimes | Lambda functions deployed as container images are pulled from Amazon ECR and scanned for OS and application vulnerabilities. |
| Lambda layers | Attached layers are inspected for vulnerable packages introduced via shared dependencies. |
| Function configuration | Function permissions, runtime settings, and policy details are collected for security context. |
Supported Architectures
| Architecture | Lambda Architecture | Docker Platform |
|---|---|---|
| x86_64 (Intel/AMD) | x86_64 | linux/amd64 |
| ARM64 (Graviton) | arm64 | linux/arm64 |
Where to View Scan Results
Lambda function scan results are available from:
Container Security > Assets > Serverless Functions
From this view you can see discovered Lambda functions with vulnerability counts, severity ratings, and scan status across all onboarded accounts and regions.
Deployment Model
Lambda scanning is deployed using AWS CloudFormation templates provided by Qualys. The deployment consists of two stacks.
- Service Account stack: Deploys the qualys-cloud-operator Lambda function, SQS queues, DynamoDB tables, EventBridge rules, and associated IAM roles. This is the central scanning and orchestration account.
- Target Account stack: Deploys a cross-account IAM role and EventBridge forwarding rules in each AWS account you want to scan. The target account automatically registers itself with the service account on stack creation.
For deployment steps, see Deploy Cloud Formation Template (CFT) using CLI.
Lambda scanning and Fargate inventory share the same service account infrastructure. You can enable both features on a single service account stack using the EnableLambdaScanning and EnableFargateInventory parameters.