Skip to content

Commit e35be28

Browse files
florentinlflorentinl
committed
application_security: one page per language
1 parent ff0d5c5 commit e35be28

File tree

8 files changed

+1286
-457
lines changed

8 files changed

+1286
-457
lines changed

‎content/en/security/application_security/setup/aws/lambda/_index.md‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -31,12 +31,11 @@ Learn how to setup App and API Protection (AAP) on your AWS Lambda functions by
3131

3232
{{< appsec-integrations >}}
3333
{{< appsec-integration name="Python" avatar="python" link="./python" >}}
34-
{{< appsec-integration name="Node.js" avatar="node" link="./generic" >}}
35-
{{< appsec-integration name="Java" avatar="java" link="./generic" >}}
36-
{{< appsec-integration name="Go" avatar="go" link="./generic" >}}
37-
{{< appsec-integration name="Ruby" avatar="ruby" link="./generic" >}}
38-
{{< appsec-integration name=".NET" avatar="dotnet" link="./generic" >}}
39-
{{< appsec-integration name="PHP" avatar="php" link="./generic" >}}
34+
{{< appsec-integration name="Node.js" avatar="node" link="./nodejs" >}}
35+
{{< appsec-integration name="Java" avatar="java" link="./java" >}}
36+
{{< appsec-integration name="Go" avatar="go" link="./go" >}}
37+
{{< appsec-integration name="Ruby" avatar="ruby" link="./ruby" >}}
38+
{{< appsec-integration name=".NET" avatar="dotnet" link="./dotnet" >}}
4039
{{< /appsec-integrations >}}
4140

4241
## Further Reading

‎content/en/security/application_security/setup/aws/lambda/dotnet.md‎

Lines changed: 240 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,240 @@
1+
---
2+
title: Enabling App and API Protection for AWS Lambda functions in .NET
3+
further_reading:
4+
- link: "/security/application_security/how-it-works/"
5+
tag: "Documentation"
6+
text: "How App and API Protection Works"
7+
- link: "/security/default_rules/?category=cat-application-security"
8+
tag: "Documentation"
9+
text: "OOTB App and API Protection Rules"
10+
- link: "/security/application_security/troubleshooting"
11+
tag: "Documentation"
12+
text: "Troubleshooting App and API Protection"
13+
- link: "/security/application_security/threats/"
14+
tag: "Documentation"
15+
text: "App and API Protection"
16+
- link: "https://www.datadoghq.com/blog/datadog-security-google-cloud/"
17+
tag: "Blog"
18+
text: "Datadog Security extends compliance and threat protection capabilities for Google Cloud"
19+
---
20+
21+
Configuring App and API Protection (AAP) for AWS Lambda involves:
22+
23+
1. Identifying functions that are vulnerable or are under attack, which would most benefit from AAP. Find them on [the Security tab of your Software Catalog][1].
24+
2. Setting up AAP instrumentation by using either the [Datadog CLI](https://docs.datadoghq.com/serverless/serverless_integrations/cli), [AWS CDK](https://github.com/DataDog/datadog-cdk-constructs), [Datadog Serverless Framework plugin][7], or manually by using the Datadog tracing layers.
25+
3. Triggering security signals in your application and seeing how Datadog displays the resulting information.
26+
27+
## Prerequisites
28+
29+
- [Serverless APM Tracing][apm-lambda-tracing-setup] is setup on the Lambda function to send traces directly to Datadog.
30+
X-Ray tracing, by itself, is not sufficient for AAP and requires APM Tracing to be enabled.
31+
32+
## Compatibility
33+
34+
**Note**: Threat Protection through Remote Configuration is not supported. Use [Workflows][5] to block IPs in your [WAF][6].
35+
36+
## Supported trigger types
37+
Threat Detection supports HTTP requests as function input only, as that channel has the highest likelihood of attackers exploiting a serverless application. HTTP requests typically come from AWS services such as:
38+
- Application Load Balancer (ALB)
39+
- API Gateway v1 (Rest API)
40+
- API Gateway v2 (HTTP API)
41+
- Function URL
42+
43+
<div class="alert alert-info">If you would like to see support added for any of the unsupported capabilities, fill out this <a href="https://forms.gle/gHrxGQMEnAobukfn7">form</a> to send feedback.</div>
44+
45+
46+
## Get started
47+
48+
{{< tabs >}}
49+
{{% tab "Serverless Framework" %}}
50+
51+
The [Datadog Serverless Framework plugin][7] can be used to automatically configure and deploy your lambda with AAP.
52+
53+
To install and configure the Datadog Serverless Framework plugin:
54+
55+
1. Install the Datadog Serverless Framework plugin:
56+
```sh
57+
serverless plugin install --name serverless-plugin-datadog
58+
```
59+
60+
2. Enable AAP by updating your `serverless.yml` with the `enableASM` configuration parameter:
61+
```yaml
62+
custom:
63+
datadog:
64+
enableASM: true
65+
```
66+
67+
Overall, your new `serverless.yml` file should contain at least:
68+
```yaml
69+
custom:
70+
datadog:
71+
apiKeySecretArn: "{Datadog_API_Key_Secret_ARN}" # or apiKey
72+
enableDDTracing: true
73+
enableASM: true
74+
```
75+
See also the complete list of [plugin parameters][9] to further configure your lambda settings.
76+
77+
4. Redeploy the function and invoke it. After a few minutes, it appears in [AAP views][3].
78+
79+
{{% /tab %}}
80+
{{% tab "Datadog CLI" %}}
81+
82+
The Datadog CLI modifies existing Lambda function configurations to enable instrumentation without requiring a new deployment. It is the quickest way to get started with Datadog's serverless monitoring.
83+
84+
**If you are configuring initial tracing for your functions**, perform the following steps:
85+
86+
1. Install the Datadog CLI client:
87+
88+
```sh
89+
npm install -g @datadog/datadog-ci
90+
```
91+
92+
2. If you are new to Datadog serverless monitoring, launch the Datadog CLI in interactive mode to guide your first installation for a quick start, and you can ignore the remaining steps. To permanently install Datadog for your production applications, skip this step and follow the remaining ones to run the Datadog CLI command in your CI/CD pipelines after your normal deployment.
93+
94+
```sh
95+
datadog-ci lambda instrument -i --appsec
96+
```
97+
98+
3. Configure the AWS credentials:
99+
100+
Datadog CLI requires access to the AWS Lambda service, and depends on the AWS JavaScript SDK to [resolve the credentials][10]. Ensure your AWS credentials are configured using the same method you would use when invoking the AWS CLI.
101+
102+
4. Configure the Datadog site:
103+
104+
```sh
105+
export DATADOG_SITE="<DATADOG_SITE>"
106+
```
107+
108+
Replace `<DATADOG_SITE>` with {{< region-param key="dd_site" code="true" >}} (ensure the correct **Datadog site** is selected on the right-hand side of this page).
109+
110+
5. Configure the Datadog API key:
111+
112+
Datadog recommends saving the Datadog API key in AWS Secrets Manager for security. The key needs to be stored as a plaintext string (not a JSON blob). Ensure your Lambda functions have the required `secretsmanager:GetSecretValue` IAM permission.
113+
114+
```sh
115+
export DATADOG_API_KEY_SECRET_ARN="<DATADOG_API_KEY_SECRET_ARN>"
116+
```
117+
118+
For testing purposes, you can also set the Datadog API key in plaintext:
119+
120+
```sh
121+
export DATADOG_API_KEY="<DATADOG_API_KEY>"
122+
```
123+
124+
6. Instrument your Lambda functions:
125+
126+
To instrument your Lambda functions, run the following command.
127+
128+
```sh
129+
datadog-ci lambda instrument --appsec -f <functionname> -f <another_functionname> -r <aws_region> -v {{< latest-lambda-layer-version layer="dd-trace-dotnet" >}} -e {{< latest-lambda-layer-version layer="extension" >}}
130+
```
131+
132+
To fill in the placeholders:
133+
- Replace `<functionname>` and `<another_functionname>` with your Lambda function names.
134+
- Alternatively, you can use `--functions-regex` to automatically instrument multiple functions whose names match the given regular expression.
135+
- Replace `<aws_region>` with the AWS region name.
136+
137+
**Note**: Instrument your Lambda functions in a development or staging environment first. If the instrumentation result is unsatisfactory, run `uninstrument` with the same arguments to revert the changes.
138+
139+
Additional parameters can be found in the [CLI documentation][11].
140+
141+
{{% /tab %}}
142+
{{% tab "AWS CDK" %}}
143+
144+
The [Datadog CDK Construct][12] automatically installs Datadog on your functions using Lambda Layers, and configures your functions to send metrics, traces, and logs to Datadog through the Datadog Lambda Extension.
145+
146+
1. Install the Datadog CDK constructs library:
147+
148+
```sh
149+
# For AWS CDK v1
150+
npm install datadog-cdk-constructs --save-dev
151+
152+
# For AWS CDK v2
153+
npm install datadog-cdk-constructs-v2 --save-dev
154+
```
155+
156+
2. Instrument your Lambda functions
157+
158+
```typescript
159+
// For AWS CDK v1
160+
import { Datadog } from "datadog-cdk-constructs";
161+
// NOT SUPPORTED IN V1
162+
163+
// For AWS CDK v2
164+
import { Datadog } from "datadog-cdk-constructs-v2";
165+
166+
const datadog = new Datadog(this, "Datadog", {
167+
dotnet_layer_version: {{< latest-lambda-layer-version layer="dd-trace-dotnet" >}},
168+
extension_layer_version: {{< latest-lambda-layer-version layer="extension" >}},
169+
site: "<DATADOG_SITE>",
170+
api_key_secret_arn: "<DATADOG_API_KEY_SECRET_ARN>", // or api_key
171+
enable_asm: true,
172+
});
173+
datadog.add_lambda_functions([<LAMBDA_FUNCTIONS>]);
174+
```
175+
176+
To fill in the placeholders:
177+
- Replace `<DATADOG_SITE>` with {{< region-param key="dd_site" code="true" >}} (ensure the correct SITE is selected on the right).
178+
- Replace `<DATADOG_API_KEY_SECRET_ARN>` with the ARN of the AWS secret where your [Datadog API key][13] is securely stored. The key needs to be stored as a plaintext string (not a JSON blob). The `secretsmanager:GetSecretValue` permission is required. For quick testing, you can use `apiKey` instead and set the Datadog API key in plaintext.
179+
180+
More information and additional parameters can be found on the [Datadog CDK documentation][12].
181+
182+
{{% /tab %}}
183+
{{% tab "Custom" %}}
184+
185+
1. Install the Datadog tracer by configuring the layer ARN that matches your deployment. Replace `<AWS_REGION>` with a valid AWS region such as `us-east-1`:
186+
```sh
187+
# x86-based Lambda in AWS commercial regions
188+
arn:aws:lambda:<AWS_REGION>:464622532012:layer:dd-trace-dotnet:{{< latest-lambda-layer-version layer="dd-trace-dotnet" >}}
189+
# arm64-based Lambda in AWS commercial regions
190+
arn:aws:lambda:<AWS_REGION>:464622532012:layer:dd-trace-dotnet-ARM:{{< latest-lambda-layer-version layer="dd-trace-dotnet" >}}
191+
# x86-based Lambda in AWS GovCloud regions
192+
arn:aws-us-gov:lambda:<AWS_REGION>:002406178527:layer:dd-trace-dotnet:{{< latest-lambda-layer-version layer="dd-trace-dotnet" >}}
193+
# arm64-based Lambda in AWS GovCloud regions
194+
arn:aws-us-gov:lambda:<AWS_REGION>:002406178527:layer:dd-trace-dotnet-ARM:{{< latest-lambda-layer-version layer="dd-trace-dotnet" >}}
195+
```
196+
197+
2. Install the Datadog Lambda Extension by configuring the layers for your Lambda function using the ARN in one of the following formats. Replace `<AWS_REGION>` with a valid AWS region such as `us-east-1`:
198+
```sh
199+
# x86-based Lambda in AWS commercial regions
200+
arn:aws:lambda:<AWS_REGION>:464622532012:layer:Datadog-Extension:{{< latest-lambda-layer-version layer="extension" >}}
201+
# arm64-based Lambda in AWS commercial regions
202+
arn:aws:lambda:<AWS_REGION>:464622532012:layer:Datadog-Extension-ARM:{{< latest-lambda-layer-version layer="extension" >}}
203+
# x86-based Lambda in AWS GovCloud regions
204+
arn:aws-us-gov:lambda:<AWS_REGION>:002406178527:layer:Datadog-Extension:{{< latest-lambda-layer-version layer="extension" >}}
205+
# arm64-based Lambda in AWS GovCloud regions
206+
arn:aws-us-gov:lambda:<AWS_REGION>:002406178527:layer:Datadog-Extension-ARM:{{< latest-lambda-layer-version layer="extension" >}}
207+
```
208+
209+
3. Enable AAP by adding the following environment variables on your function deployment:
210+
```yaml
211+
environment:
212+
AWS_LAMBDA_EXEC_WRAPPER: /opt/datadog_wrapper
213+
DD_SERVERLESS_APPSEC_ENABLED: true
214+
```
215+
216+
4. Redeploy the function and invoke it. After a few minutes, it appears in [AAP views][3].
217+
218+
[15]: https://docs.aws.amazon.com/lambda/latest/dg/configuration-layers.html
219+
220+
{{% /tab %}}
221+
{{< /tabs >}}
222+
223+
## Further reading
224+
225+
{{< partial name="whats-next/whats-next.html" >}}
226+
227+
[1]: https://app.datadoghq.com/services?query=type%3Afunction%20&env=prod&groupBy=&hostGroup=%2A&lens=Security&sort=-attackExposure&view=list
228+
[2]: /serverless/distributed_tracing/
229+
[3]: https://app.datadoghq.com/security/appsec?column=time&order=desc
230+
[5]: /actions/workflows/
231+
[6]: /security/application_security/waf-integration/
232+
[7]: https://docs.datadoghq.com/serverless/serverless_integrations/plugin
233+
[8]: https://docs.datadoghq.com/serverless/libraries_integrations/extension
234+
[9]: https://docs.datadoghq.com/serverless/libraries_integrations/plugin/#configuration-parameters
235+
[10]: https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/setting-credentials-node.html
236+
[11]: https://docs.datadoghq.com/serverless/serverless_integrations/cli
237+
[12]: https://github.com/DataDog/datadog-cdk-constructs
238+
[13]: https://app.datadoghq.com/organization-settings/api-keys
239+
[15]: https://docs.aws.amazon.com/lambda/latest/dg/configuration-layers.html
240+
[apm-lambda-tracing-setup]: https://docs.datadoghq.com/serverless/aws_lambda/distributed_tracing/

0 commit comments

Comments
 (0)