Scan AWS Lambda Function
This topic explains how Qualys CS Sensor scans your AWS Lambda function.
Key Concepts
-
Service Account
A Service Account is the AWS account where the Qualys Cloud Scanning Infrastructure is deployed and managed. It hosts the core Qualys scanning components, such as: Cloud Operator Lambda function, Orchestrator Lambda function, EventBridge rules, SQS queues, DynamoDB tables, CloudWatch alarms, Cross-account scanning infrastructure.
The Service Account serves as the central scanning and orchestration account, coordinating Lambda function discovery and vulnerability scanning. A Service account has primary and secondary regions. -
Target Account
A Target Account is the AWS account that contains the Lambda functions you want Qualys to scan.
The Target Account does not host the main Qualys scanning infrastructure. Instead, it contains: Lambda workloads to be scanned, EventBridge rules and permissions required to communicate with the Service Account. - ServiceAccountRegion
ServiceAccountRegion is the AWS Region where the Service Account CloudFormation stack and the Qualys Lambda scanning infrastructure are deployed. This parameter is specified when creating the Target Account stack so that the target account knows where to communicate with the centralized Qualys scanning components. - SecondaryRegions
SecondaryRegions is a list of AWS Regions, excluding the primary deployment region, where Qualys should deploy supporting resources to discover and scan Lambda functions.
This enables multi-region Lambda scanning.
How does Qualys scan an AWS Function?
This section explains how Qualys Container Security scans your AWS Lambda function as part of Qualys Cloud Scanning Infrastructure.
Pre-requisite
Before you begin, make sure you have the following items ready for Cloud Scanning Infrastructure.
- From your AWS account, the ServiceAccountId where you want to deploy the Service Account stack.
- From your AWS account, the TargetAccountId or OrganizationId where you want to deploy the Target Account stack. i.e. the target account of lambda functions which you want to scan.
- Qualys CloudFormation templates (CFT).
- CFT for Service account.
URL: https://<>.s3.amazonaws.com/< service-account-scanning.yaml> - CFT for Target account
URL: https://<>.s3.amazonaws.com/< target-account-scanning.yaml>
- CFT for Service account.
- Environment details for your Qualys subscription:
- Qualys Cloud Operator Image from Dockerhub.
Refer to How to Get the Qualys Cloud Operator Image? - Authorization
Access Token
Configurations > Access Token
OR
ClientID, SecretID
- Gateway URL: Qualys Enterprise TruRisk™ Platform (POD) gateway URL for backend communication.
- Optional parameters, proxy or VPC, if required.
- Qualys Cloud Operator Image from Dockerhub.
Supported Architecture
Qualys Container Security supports Cloud Operator Image for the following architectures.
| Architecture | Lambda Architecture | Docker Platform |
|---|---|---|
| ARM64 (Graviton) | arm64 | linux/arm64 |
| x86_64 (Intel/AMD) | x86_64 | linux/amd64 |
How to Get the Qualys Cloud Operator Image?
You have these options for the Qualys Cloud Operator image:
•Use from Docker Hub directly
•Use from Docker Hub but push the image to your ECR repository (public)
The sections that follow describe these options in more detail.
Use from Docker Hub directly
You can use the sensor image directly from Docker Hub. The Container Security Sensor on Docker Hub is available as:
qualys/cloud-operator:latest
Look up the most recent tag in Docker Hub.
Use from Docker Hub but push the image to your ECR repository (public)
Use the following commands to push the Qualys Cloud Operator image to the ECR public repository:
sudo docker pull qualys/cloud-operator:latest
sudo docker tag qualys/cloud-operator:latest <URL to push image to ECR public repository>
sudo docker push <URL to push image to ECR public repository>
For example:
sudo docker pull qualys/cloud-operator:latest
sudo docker tag c3fa63a818df public.ecr.aws/y4h7m2t8/qualys/cloud-operator:latest
sudo docker push public.ecr.aws/y4h7m2t8/qualys/cloud-operator:latest
AWS Lambda function Scan
We use AWS CloudFormation template > CloudFormation Stack for scanning AWS Lambda functions.
You can create a CloudFormation Stack for a Service Account & a Target Account.
Do not create Service Account Stack and Target Account Stack in the same AWS account.
Follow these deployment instructions to create AWS Cloud Formation Stack.
- Log in to your AWS Console.
- Go to CloudFormation, click Create Stack, and select With new Resources.
- Select the Amazon S3 URL field, and Specify template.
- To create the Service Account Cloud Formation Stack,
Specify the S3 URL of the Service Account CFT (see URL in the Prerequisite section).
To create the Target Account Cloud Formation Stack,
Specify the S3 URL of the Target Account CFT.
Then, click Next to continue to the template configuration.
4. Under Stack name,
If you are creating a Service Account Stack,
Enter a name for the Qualys AWS Cloud scanning stack (Lambda function), such as 'qualys-cs-cloud-scanning'.
If you are creating a Target Account Stack,
Enter a name for the Qualys AWS Cloud scanning stack (Lambda function), such as 'qualys-cs-cloud-scanning'.
5. Under Parameters, provide environment details for your subscription, including Gateway URL, Qualys Access Token (OR QualysClientId, QualysClientSecret), and so on.
The table below explains the parameters for the Service Account Stack.
| Parameter Name | Mandatory | Default Value | Description |
|---|---|---|---|
| CloudOperatorImageUri | Yes | --- | ECR image URI in the same region as the stack |
| QualysAccessToken OR QualysClientId QualysClientSecret |
Yes | --- | Used for authorization. You can either use QualysAccessToken or QualysClientID, QualysClientSecret |
| GatewayURL | Yes | --- | Qualys Gateway URL. |
| OrganizationId | No | --- | Mandatory if you want to scan a Lambda function from a target account. |
| TargetAccountIds | No | --- | Mandatory if you want to scan a Lambda function from a target account. |
| SecondaryRegions | No | --- | Regions beyond the deploy region; deploys StackSet |
| ScanServiceAccount | No | true | To scan only service accounts. Set false to scan only secondary regions. |
| OrchestratorMemorySize | No | 2048 | --- |
| OrchestratorTimeout | No | 900 (max) | --- |
| CloudOperatorLambdaArchitecture | Yes | x86_64 | Architecture for Lambda function (x86_64 or arm64) |
| LogLevel | Yes | Info | Log level for Lambda functions (debug, info, warn, error, fatal) |
The table below explains the parameters for the Target Account Stack.
| Parameter Name | Mandatory | Default Value | Description |
|---|---|---|---|
| SecondaryRegions | No | -- | Additional regions (beyond the stack deploy region) to deploy EventBridge rules for cross-region Lambda detection (e.g., sa-east-1,eu-west-1). Must not include the stack deploy region. |
| ServiceAccountId | Yes | -- | AWS Account ID of the service account where the Lambda scanning infrastructure is deployed. |
| ServiceAccountRegion | Yes | -- | AWS region where the service account stack is deployed. For example, us-west-2 |
6. Click Next to continue through the workflow. Acknowledge the Capabilities box.
7. Click Create stack. That’s it!
Resources Created
When the stack creation is successful, several resources are created, and they’ll appear in the Resources section, as shown below.
Here’s another look at the resources created for a Service Account stack named 'qualys-cs-cloud-scanning'.
| Logical ID | Type |
| CloudOperator | AWS::Lambda::Function |
| CloudOperatorEventSourceMapping | AWS::Lambda::EventSourceMapping |
| CloudOperatorLogGroup | AWS ::Logs::LogGroup |
| CloudOperatorOnboardingEventSourceMapping | AWS::Lambda::EventSourceMapping |
| CrossRegionEventBusPolicy | AWS::Events::EventBusPolicy |
| CrossRegionForwardingRule | AWS::Events::Rule |
| DLQMessagesAlarm | AWS::CloudWatch::Alarm |
| EventBridgeToSQSRole | AWS::IAM::Role |
| InitialScanTrigger | Custom::InitialScan |
| LambdaEventsDLQ | AWS::SQS::Queue |
| LambdaEventsQueue | AWS::SQS::Queue |
| LambdaEventsQueuePolicy | AWS::SQS::QueuePolicy |
| LambdaFunctionEventsRule | AWS::Events::Rule |
| LambdaScanJobsTable | AWS::DynamoDB::Table |
| OnboardedAccountsTable | AWS::DynamoDB::Table |
| OnboardingEventsDLQ | AWS::SQS::Queue |
| OnboardingEventsQueue | AWS::SQS::Queue |
| OnboardingEventsQueuePolicy | AWS::SQS::QueuePolicy |
| OrchestratorErrorAlarm | AWS::CloudWatch::Alarm |
| OrchestratorExecutionRole | AWS::IAM::Role |
| OrganizationEventBusPolicy | AWS::Events::EventBusPolicy |
| SecondaryRegionEventBridgeStackSet | AWS::CloudFormation::StackSet |
| SQSQueueDepthAlarm | AWS::CloudWatch::Alarm |
| StackSetAdministrationRole | AWS::IAM::Role |
| StackSetExecutionRole | AWS::IAM::Role |
Here’s another look at the resources created for a Target Account stack named 'qualys-lambda-scanning-target'.
| Logical ID | Type |
|---|---|
| CrossAccountRole | AWS::IAM::Role |
| EventBridgeToSQSRole | AWS::IAM::Role |
| LambdaFunctionEventsRule | AWS::Events::Rule |
| TargetAccountOnboardingNotifier | Custom::TargetAccountOnboardingNotifier |
| TargetAccountOnboardingNotifierFunction | AWS::Lambda::Function |
| TargetAccountOnboardingNotifierRole | AWS::IAM::Role |