1. Overview

Prisma Cloud Serverless Defenders protect serverless functions at runtime. Currently, Prisma Cloud supports AWS Lambda functions.

Lambda layers are ZIP archives that contain libraries, custom runtimes, or other dependencies. Layers let you add reusable components to your functions, and focus deployment packages on business logic. They are extracted to the /opt directory in the function execution environment. For more information, see the AWS Lambda layers documentation.

Prisma Cloud delivers Serverless Defender as a Lambda layer. Deploy Serverless Defender to your function by wrapping the handler and setting an environment variable.

The following runtimes are supported for Serverlerss Defender as a Lambda layer:

  • Node.js 10.x, 12.x

  • Python 2.7, 3.6, 3.7 and 3.8

2. Securing serverless functions

To secure an AWS Lambda function with the Serverless Defender layer:

  1. Download the Serverless Defender Lambda layer ZIP file.

  2. Upload the layer to AWS.

  3. Define a serverless protection runtime policy.

  4. Define a serverless WAAS policy.

  5. Add the layer to your function, update the handler, and set an environment variable. After completing this integration, Serverless Defender runs when your function is invoked.

3. Download the Serverless Defender layer

Download the Serverless Defender layer from Compute Console.

  1. Open Console, then go to Manage > Defenders > Deploy.

  2. Choose the DNS name or IP address that Serverless Defender uses to connect to Console.

  3. Set the Defender type to Serverless.

  4. Select a runtime.

    Prisma Cloud supports Lambda layers for Node.js and Python only.

  5. For Deployment Type, select Layer.

  6. Download the Serverless Defender layer. A ZIP file is downloaded to your host.

4. Upload the Serverless Defender layer to AWS

Add the layer to the AWS Lambda service as a resource available to all functions.

  1. In the AWS Management Console, go to the Lambda service.

  2. Click Layers.

    serverless layer layers
  3. In Name, enter twistlock.

  4. Click Upload, and select the file you just downloaded, twistlock_defender_layer.zip

    1. Select the compatible runtimes: Python or Node.js.

    2. Click Create.

      serverless layer create

5. Defining your runtime protection policy

Prisma Cloud ships with a default runtime policy for all serverless functions that blocks all processes from running except the main process. This default policy protects against command injection attacks.

You can customize the policy with additional rules. By default, new rules apply to all functions (*), but you can target them to specific functions by function name.

When functions are invoked, they connect to Compute Console and retrieve the latest policy. To ensure that functions start executing at time=0 with your custom policy, you must predefine the policy. Predefined policy is embedded into your function along with the Serverless Defender by way of the TW_POLICY environment variable.

  1. Log into Prisma Cloud Console.

  2. Go to Defend > Runtime > Serverless Policy.

  3. Click Add rule.

  4. In the General tab, enter a rule name.

  5. (Optional) Target the rule to specific functions.

  6. Set the rule parameters in the Processes, Networking, and File System tabs.

  7. Click Save.

6. Defining your serverless WAAS policy

Prisma Cloud lets you protect your serverless functions against application layer attacks by utlizing the serverless Web Application and API Security (WAAS).

By default, the serverless WAAS is disabled. To enable it, add a new serverless WAAS rule.

  1. Log into Prisma Cloud Console.

  2. Go to Defend > WAAS > Serverless.

  3. Click Add rule.

  4. In the General tab, enter a rule name.

  5. (Optional) Target the rule to specific functions.

  6. Set the protections you want to apply (SQLi, CMDi, Code injection, XSS, LFI).

  7. Click Save.

7. Embed the Serverless Defender

Embed the Serverless Defender as a layer, and run it when your function is invoked. If you are using a deployment framework such as SAM or Serverless Framework you can reference the layer from within the configuration file.


  • You already have a Lambda function.

  • Your Lambda function is written for Node.js 10.x or Python.

  • Your function’s execution role grants it permission to write to CloudWatch Logs. Note that the AWSLambdaBasicExecutionRole grants permission to write to CloudWatch Logs.

  1. Go to the function designer in the AWS Management Console.

  2. Click on the Layers icon.

    serverless layer function designer layers
  3. In the Referenced Layers panel, click Add a layer.

    serverless layer add a layer
    1. In the Select from list of runtime compatible layers, select twistlock.

    2. In the Version drop-down list, select 1.

    3. Click Add.