5 ways to secure AWS Lambda for compliance requirements

One of the most critical ways to protect your Lambda functions is to control access to them with identity and access management (IAM) policies. These policies should define who has access and what they can access. 

In addition, you can leverage tags for fine-grained access to your Lambda functions, versions, and layers. For example, tags based on data owner, environment, and application allow you to conveniently filter and manage Lambda resources. For Lambda functions with attached security groups, use matching tags between the function and group to improve consistency and compliance audit visibility.

By default, Lambda permits public internet access to a function. For compliance reasons, you should disable public Lambda access and trigger functions only from a virtual private cloud (VPC) or authorized service to limit exposure and prevent invocation by unauthorized entities. 

Attaching Lambda functions to VPCs protects access to back-end databases and services without exposing them to the public internet. Furthermore, you can use security groups to control network-level access at a more granular level.

You can also use the Amazon API Gateway to handle authentication, authorization, rate throttling, and other API management policies before invoking the Lambda function. Leveraging the gateway allows security teams to protect functions from malicious DDoS attacks that cause service interruption.

AWS Key Management Service (KMS) gives you the ability to leverage cryptographic keys for encrypting and decrypting data. By encrypting sensitive data such as Lambda environment variables, you can protect confidentiality. 

KMS integrates with Secrets Manager and Parameter Store for encryption using customer master keys. Secrets Manager can securely store secrets like the API keys used and accessed by Lambda functions, with key rotation capabilities. Parameter Store securely stores configuration parameters like database connection strings retrieved by Lambda functions during execution.