lambda-security-scanner 1.0.0__py3-none-any.whl

lambda_security_scanner/checks/base.py

@@ -0,0 +1,104 @@
+"""Base class for all security checkers."""
+
+import logging
+
+import boto3
+from botocore.exceptions import ClientError
+from typing import Dict, Any
+
+
+logger = logging.getLogger("lambda_security_scanner")
+
+
+class BaseChecker:
+    """Base class for all security checkers.
+
+    Provides thread-safe AWS client creation via session_factory
+    and standardized error handling.
+    """
+
+    def __init__(self, session_factory=None):
+        """Initialize the checker with optional session factory.
+
+        Args:
+            session_factory: Callable that returns a boto3 session
+                (for thread safety) or a boto3 session object
+                (for backward compatibility).
+        """
+        self.session_factory = session_factory
+
+    def get_client(self, service_name: str, region_name: str = None):
+        """Get AWS client for the specified service.
+
+        Uses the thread-safe session factory to create clients,
+        ensuring each thread gets its own session.
+
+        Args:
+            service_name: AWS service name (e.g., 'lambda', 'iam')
+            region_name: AWS region name (optional)
+
+        Returns:
+            boto3 client for the service
+        """
+        if self.session_factory:
+            session = (
+                self.session_factory()
+                if callable(self.session_factory)
+                else self.session_factory
+            )
+            kwargs = (
+                {"region_name": region_name} if region_name else {}
+            )
+            return session.client(service_name, **kwargs)
+        else:
+            kwargs = (
+                {"region_name": region_name} if region_name else {}
+            )
+            return boto3.client(service_name, **kwargs)
+
+    def handle_client_error(
+        self, e: ClientError, default_response: Dict[str, Any] = None
+    ) -> Dict[str, Any]:
+        """Handle ClientError exceptions consistently.
+
+        Logs the error and returns a safe default response dict.
+        Special handling for AccessDeniedException and
+        ResourceNotFoundException.
+
+        Args:
+            e: ClientError exception
+            default_response: Default response dict to return
+
+        Returns:
+            Error response dict with 'error' key
+        """
+        error_code = e.response.get("Error", {}).get(
+            "Code", "Unknown"
+        )
+        error_msg = str(e)
+
+        if error_code in (
+            "AccessDeniedException",
+            "AccessDenied",
+            "UnauthorizedOperation",
+            "AuthFailure",
+        ):
+            logger.warning(
+                f"Access denied ({error_code}): {error_msg} - "
+                "scan will continue with limited results"
+            )
+        elif error_code == "ResourceNotFoundException":
+            logger.debug(
+                f"Resource not found (expected): {error_msg}"
+            )
+        else:
+            logger.warning(f"AWS API error: {error_msg}")
+
+        if default_response is None:
+            default_response = {
+                "error": error_msg,
+            }
+        else:
+            default_response["error"] = error_msg
+
+        return default_response

lambda_security_scanner/checks/code_security.py

@@ -0,0 +1,212 @@
+"""Code security checks for Lambda functions (E.1-E.2)."""
+
+import logging
+from typing import Dict, List
+
+from botocore.exceptions import ClientError
+
+from .base import BaseChecker
+
+logger = logging.getLogger("lambda_security_scanner")
+
+
+class CodeSecurityChecker(BaseChecker):
+    """Check code security configuration for Lambda functions.
+
+    Implements checks E.1 (code signing) and
+    E.2 (event source mapping failure destinations).
+    """
+
+    def check_code_signing(
+        self,
+        function_name: str,
+        region: str,
+        package_type: str = "Zip",
+    ) -> Dict:
+        """E.1 - Check code signing configuration.
+
+        Skips container image functions (package_type=Image).
+
+        Args:
+            function_name: Lambda function name.
+            region: AWS region name.
+            package_type: "Zip" or "Image".
+
+        Returns:
+            Dict with configured, policy, config_arn,
+            is_enforced.
+        """
+        if package_type == "Image":
+            # AWS Lambda Code Signing is not supported for container
+            # image functions (only Zip packages). Returning
+            # applicable=False so scoring/issues skip the check
+            # rather than falsely reporting "enforced".
+            return {
+                "configured": False,
+                "policy": None,
+                "config_arn": None,
+                "is_enforced": False,
+                "applicable": False,
+            }
+
+        lambda_client = self.get_client("lambda", region)
+
+        try:
+            response = (
+                lambda_client
+                .get_function_code_signing_config(
+                    FunctionName=function_name
+                )
+            )
+        except ClientError as e:
+            error_code = e.response.get("Error", {}).get(
+                "Code", ""
+            )
+            if error_code == "ResourceNotFoundException":
+                logger.debug(
+                    "No code signing config for %s",
+                    function_name,
+                )
+                return {
+                    "configured": False,
+                    "policy": None,
+                    "config_arn": None,
+                    "is_enforced": False,
+                }
+            return self.handle_client_error(
+                e,
+                {
+                    "configured": False,
+                    "policy": None,
+                    "config_arn": None,
+                    "is_enforced": False,
+                },
+            )
+
+        config_arn = response.get("CodeSigningConfigArn")
+        if not config_arn:
+            return {
+                "configured": False,
+                "policy": None,
+                "config_arn": None,
+                "is_enforced": False,
+            }
+
+        try:
+            csc_response = (
+                lambda_client.get_code_signing_config(
+                    CodeSigningConfigArn=config_arn
+                )
+            )
+        except ClientError as e:
+            return self.handle_client_error(
+                e,
+                {
+                    "configured": True,
+                    "policy": None,
+                    "config_arn": config_arn,
+                    "is_enforced": False,
+                },
+            )
+
+        csc = csc_response.get("CodeSigningConfig", {})
+        policies = csc.get("CodeSigningPolicies", {})
+        policy = policies.get(
+            "UntrustedArtifactOnDeployment"
+        )
+
+        return {
+            "configured": True,
+            "policy": policy,
+            "config_arn": config_arn,
+            "is_enforced": policy == "Enforce",
+        }
+
+    def check_event_source_mappings(
+        self, function_name: str, region: str
+    ) -> Dict:
+        """E.2 - Check event source mappings for failure dest.
+
+        Uses paginator to list all event source mappings.
+
+        Args:
+            function_name: Lambda function name.
+            region: AWS region name.
+
+        Returns:
+            Dict with mapping_count, mappings,
+            missing_failure_dest_count,
+            missing_failure_destinations, has_mappings.
+        """
+        try:
+            lambda_client = self.get_client(
+                "lambda", region
+            )
+            paginator = lambda_client.get_paginator(
+                "list_event_source_mappings"
+            )
+            page_iterator = paginator.paginate(
+                FunctionName=function_name
+            )
+        except ClientError as e:
+            return self.handle_client_error(
+                e,
+                {
+                    "mapping_count": 0,
+                    "mappings": [],
+                    "missing_failure_dest_count": 0,
+                    "missing_failure_destinations": [],
+                    "has_mappings": False,
+                },
+            )
+
+        mappings = []
+        missing_failure_destinations = []
+
+        try:
+            for page in page_iterator:
+                for esm in page.get(
+                    "EventSourceMappings", []
+                ):
+                    esm_info = {
+                        "EventSourceArn": esm.get(
+                            "EventSourceArn"
+                        ),
+                        "UUID": esm.get("UUID"),
+                    }
+                    mappings.append(esm_info)
+
+                    dest = (
+                        esm.get(
+                            "DestinationConfig", {}
+                        )
+                        .get("OnFailure", {})
+                        .get("Destination")
+                    )
+                    if not dest:
+                        missing_failure_destinations.append(
+                            esm.get("UUID")
+                        )
+        except ClientError as e:
+            return self.handle_client_error(
+                e,
+                {
+                    "mapping_count": 0,
+                    "mappings": [],
+                    "missing_failure_dest_count": 0,
+                    "missing_failure_destinations": [],
+                    "has_mappings": False,
+                },
+            )
+
+        return {
+            "mapping_count": len(mappings),
+            "mappings": mappings,
+            "missing_failure_dest_count": len(
+                missing_failure_destinations
+            ),
+            "missing_failure_destinations": (
+                missing_failure_destinations
+            ),
+            "has_mappings": len(mappings) > 0,
+        }