Question

A financial services company runs a large serverless application built primarily on AWS Lambda functions that process transactions and make outbound network calls to third-party APIs. The security team is concerned that a compromised function could be used to communicate with attacker-controlled infrastructure or perform cryptocurrency mining, but they currently receive no threat detection signals from the Lambda environment. They already use Amazon GuardDuty for their EC2 and S3 workloads. Which action provides the MOST effective detection of malicious network activity originating from these Lambda functions with the least operational effort?

Accepted Answer

Enable GuardDuty Lambda Protection, which analyzes VPC flow logs from Lambda function network activity to detect connections to known malicious hosts and cryptomining domains.

Answer

Enable Amazon Inspector Lambda code scanning to continuously assess the function code for vulnerabilities and generate findings for suspicious outbound calls.

Answer

Configure VPC Flow Logs on the Lambda execution subnets and build a custom Amazon Athena query to search for connections to threat-intelligence IP ranges.

Answer

Enable AWS Config rules to monitor Lambda function configuration changes and alert when new outbound network destinations are added.