Attack Vectors for APIs with AWS API Gateway Lambda Authorizers
Alexandre Sieira breaks down common implementation pitfalls and bypasses in AWS API Gateway custom Lambda authorizers.
Summary
The Shift to Serverless APIs on AWS
Modern cloud applications leverage serverless architectures (AWS SAM, Serverless Framework) combining Amazon API Gateway and AWS Lambda to process API requests at scale.
Deconstructing Custom Lambda Authorizers
Alexandre Sieira examines how Lambda authorizers validate bearer tokens, generate IAM policy documents, and cache authorization decisions for downstream routes.
Exploiting IAM Policy Caching Flaws
Sieira reveals critical vulnerabilities where flawed authorizer logic generates wildcard IAM resource policies or improperly keys policy caches, allowing unauthorized cross-tenant API access.
Hardening Serverless API Authorizers
The author provides developers with secure reference implementations and testing harnesses to validate Lambda authorization logic.
Related talks
Cloud Village·23 min
Aviram · Uri Gutman
Lessons from building a scalable security platform on serverless cloud infrastructure.
RSAC Cybersecurity·52 min
Engineers explore architecture and security mechanisms for Defending Serverless Infrastructure in the Cloud.
RSAC Cybersecurity·45 min
Security researchers examine technical aspects of Securing Serverless Applications in the Cloud.