Huge News!Announcing our $40M Series B led by Abstract Ventures.Learn More
Socket
Sign inDemoInstall
Socket

@middy/function-shield

Package Overview
Dependencies
Maintainers
11
Versions
68
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@middy/function-shield

Hardens AWS Lambda execution environment

  • 1.5.2
  • latest
  • Source
  • npm
  • Socket score

Version published
Maintainers
11
Created
Source

Middy FunctionShield middleware

Middy logo

FunctionShield middleware for the middy framework, the stylish Node.js middleware engine for AWS Lambda

npm version Known Vulnerabilities Standard Code Style Greenkeeper badge Chat on Gitter

⚠️ Warning: FunctionShield is no longer actively maintained and will unlikely be updated to have Node.js v12 support. See #460 ⚠️

Hardens AWS Lambda execution environment:

  • By monitoring (or blocking) outbound network traffic to public internet, you can be certain that your data is never leaked (traffic to AWS services is not affected)
  • By disabling read/write operations on the /tmp/ directory, you make sure that files are not persisted across invocations. Storing data in /tmp is a bad practice as it may be leaked in subsequent invocations
  • By disabling the ability to launch child processes, you can make sure that no rogue processes are spawned without your knowledge by potentially malicious packages
  • By disabling the ability to read the function's (handler) source code through the file system, you can prevent handler source code leakage, which is oftentimes the first step in a serverless attack

More info:

Get a free token

Please visit: https://www.puresec.io/function-shield-token-form

Modes

  • 'block' - Block and log to Cloudwatch Logs
  • 'alert' - Allow and log to Cloudwatch Logs
  • 'allow' - Allow

Options

  • policy.outbound_connectivity - 'block'/'alert'/'allow' (default: 'block')
  • policy.read_write_tmp - 'block'/'alert'/'allow' (default: 'block')
  • policy.create_child_process - 'block'/'alert'/'allow' (default: 'block')
  • policy.read_handler - 'block'/'alert'/'allow' (default: 'block')
  • token - By default looks for FUNCTION_SHIELD_TOKEN in process.env and context
  • disable_analytics - Periodically, during cold starts, FunctionShield sends basic analytics information to its backend. To disable analytics module set: true. (default: false)

Sample Usage

'use strict';

const fs = require('fs');
const middy = require('middy');
const {ssm, functionShield} = require('middy/middlewares');

async function hello(event) {
  fs.openSync('/tmp/test', 'w');
}


const handler = middy(hello)
  .use(ssm({
    cache: true,
    setToContext: true,
    names: {
      FUNCTION_SHIELD_TOKEN: 'function_shield_token'
    }
  }))
  .use(functionShield(
    {
      policy: {
        outbound_connectivity: 'alert'
      }
    }
  ));

module.exports = {
  handler
};
START RequestId: f7b7305d-d785-11e8-baf1-9136b5c7aa75 Version: $LATEST
[TOKEN VERIFICATION] license is OK
{"function_shield":true,"policy":"read_write_tmp","details":{"path":"/tmp/test"},"mode":"block"}
2018-10-24 15:11:45.427 (+03:00)        f7b7305d-d785-11e8-baf1-9136b5c7aa75    {"errorMessage":"Unknown system error -999: Unknown system error -999, open '/tmp/test'","errorType":"Error","stackTrace":["Object.fs.openSync (fs.js:646:18)","Function.hello (/var/task/handler.js:8:6)","runMiddlewares (/var/task/node_modules/middy/src/middy.js:180:42)","runNext (/var/task/node_modules/middy/src/middy.js:85:14)","before (/var/task/node_modules/middy/src/middlewares/functionShield.js:20:5)","runNext (/var/task/node_modules/middy/src/middy.js:70:24)","<anonymous>","process._tickDomainCallback (internal/process/next_tick.js:228:7)"]}
END RequestId: f7b7305d-d785-11e8-baf1-9136b5c7aa75
REPORT RequestId: f7b7305d-d785-11e8-baf1-9136b5c7aa75  Duration: 458.65 ms     Billed Duration: 500 ms         Memory Size: 1024 MB    Max Memory Used: 38 MB  

Middy documentation and examples

For more documentation and examples, refers to the main Middy monorepo on GitHub or Middy official website.

Contributing

Everyone is very welcome to contribute to this repository. Feel free to raise issues or to submit Pull Requests.

License

Licensed under MIT License. Copyright (c) 2017-2018 Luciano Mammino and the Middy team.

FOSSA Status

Keywords

FAQs

Package last updated on 17 Jan 2021

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc