MMNA

Input Validation Awareness

Never trust external input. Attackers craft malicious payloads to trigger code execution, data theft, or denial of service. Validate all event data.

// ❌ VULNERABLE
const user_id = event.user_id;
db.query(`SELECT * FROM users WHERE id = ${user_id}`);

// ✅ SECURE
const user_id = parseInt(event.user_id);
if (!Number.isInteger(user_id) || user_id < 1) {
  throw new Error('Invalid user_id');
}
const result = db.query(
  'SELECT * FROM users WHERE id = ?',
  [user_id]
);

• → Type Checking: Validate data types (string, number, boolean)
• → Range Validation: Check bounds (age 0-150, IDs > 0)
• → Parameterized Queries: Use placeholders, never string concatenation
• → Whitelist Patterns: Allow only known-good characters/formats

Environment Variable Management (High-Level)

Lambda can store configuration and secrets in environment variables. However, they're stored plaintext in Lambda. Use AWS Secrets Manager or Parameter Store for sensitive data.

// ❌ VULNERABLE - Secrets in environment
const db_password = process.env.DB_PASSWORD;

// ✅ SECURE - Secrets Manager
const secretsManager = 
  new AWS.SecretsManager();
const secret = await secretsManager
  .getSecretValue({SecretId: 'db-password'})
  .promise();
const db_password = secret.SecretString;

Version Control Concepts

Source code control (Git) provides audit trails, enables code review, and allows rollback of malicious or broken deployments.

• ✓
  Branch Protection

  Require pull request reviews before merging to main branch. Prevent direct pushes.

• ✓
  Code Review

  At least one other developer reviews all code changes. Catches security issues and logic bugs.

• ✓
  Commit Signing

  Use GPG signatures to verify commit author identity. Prevents attacker impersonation.

• ✓
  Audit Trail

  Every change logged with who, what, when, why. Enables forensics and compliance.

Change Management Practices

Structured process for deploying Lambda updates. Reduces risk of outages and security incidents.

• ✓
  Staged Deployments

  Deploy to dev → staging → production. Test thoroughly before production release.

• ✓
  Canary Releases

  Route small % of traffic to new version. Monitor for errors before full rollout.

• ✓
  Rollback Plan

  Keep previous version available. If new deployment breaks, quickly revert.

• ✓
  Change Log

  Document every deployment with version, date, changes, approver.