Scan Serverless Lambda Function
AWS Lambda is a serverless compute service that lets you run code without provisioning or managing servers. While Lambda simplifies operations and improves scalability, it introduces unique security challenges such as dependency vulnerabilities, misconfigurations, and runtime risks.
Container Security enables you to discover, assess, and secure AWS Lambda functions by providing visibility into function configurations, associated layers, permissions, and vulnerabilities in deployed code packages.
Supported Architecture
Qualys Container Security supports Serverless Lambda function scanning on the following architecture.
| Architecture | Lambda Architecture | Docker Platform |
|---|---|---|
| ARM64 (Graviton) | arm64 | linux/arm64 |
| x86_64 (Intel/AMD) | x86_64 | linux/amd64 |
Pre-requisites
??
How it Works
Container Security uses an event-driven, serverless architecture to discover and scan AWS Lambda functions across accounts and regions.
Initial Scan
On deployment of the CloudFormation stack, a Custom Resource automatically discovers all existing Lambda functions in the account and region.
Each discovered function is enqueued for scanning to establish the initial security baseline.
Runtime Detection
Container Security continuously monitors Lambda lifecycle events using AWS CloudTrail.
The following events trigger real-time scans:
- CreateFunction
- UpdateFunctionConfiguration
- DeleteFunction
These events are processed through the following pipeline: EventBridge > SQS > Orchestrator
This ensures that new, updated, or removed Lambda functions are scanned immediately without manual intervention.
Cross-Account Scanning
For multi-account environments:
- Target accounts deploy a lightweight CloudFormation stack (target-account-lambda-scanning.yaml)
- The stack uses an IAM execution role to forward Lambda events
- Events are pushed to an SQS queue in the service account
This enables centralized scanning and visibility across multiple AWS accounts.
Multi-Region Coverage
Container Security supports automatic multi-region scanning:
- Secondary regions are handled using CloudFormation StackSets
- EventBridge forwarding rules are deployed automatically
- No separate stack deployment is required in each region
This ensures consistent coverage across all enabled AWS regions.
Deduplication
To prevent redundant scans:
- Container Security uses atomic conditional writes in DynamoDB
- Duplicate scan requests for the same Lambda function ARN are rejected
This guarantees efficient processing and avoids unnecessary rescans.
Dead-Letter Queue Handling
If a scan request fails repeatedly, the messages that fail after 10 retry attempts, are moved to the lambda-events-dlq dead-letter queue.
This allows administrators to investigate and remediate processing issues.
Serverless Configuration
Go to the Serverless tab in Qualys Enterprise TruRisk™ Platform > Container Security > Configurations > AWS Lambda function Scan section. From here, click the Show Instructions button to open the Qualys Container Security Sensor Deployment Guide for configuration steps. After you complete the one-time configuration, ???.