Hardening Serverless APIs: Zero Trust, AWS WAF, and Threat Modeling

The pervasive assumption that migrating to Serverless inherently renders your applications secure is one of the most dangerous fallacies in modern cloud engineering. While AWS assumes physical data center security, hypervisor isolation, and operating system kernel patching under the AWS Shared Responsibility Model, application-layer security remains 100% your responsibility.

In an ephemeral, event-driven ecosystem, traditional network perimeter defenses (firewalls, static IP whitelists, bastion hosts) dissolve. Serverless functions are directly exposed to event streams, HTTP triggers, queues, and cloud storage notifications. Without a rigorous Zero Trust architecture, threat modeling, and edge protection via AWS WAF, serverless architectures are uniquely vulnerable to Denial of Wallet (DoW) attacks, event injection, broken authorization, and data exfiltration through over-privileged IAM execution roles.

💡 Executive Summary: Hardening serverless APIs requires perimeter traffic inspection with AWS WAF, strict cryptographically enforced IAM least-privilege policies, in-memory payload contract validation, and continuous threat modeling against Denial of Wallet and broken object-level authorization (BOLA).

1. Threat Modeling for Serverless: Beyond the Traditional Perimeter

In containerized or monolithic environments, threat modeling focuses heavily on server hardening, network segmentation (subnets/VPCs), and SSH access. In a serverless topology, the function is the perimeter.

According to the OWASP Top 10 for Serverless and Cloud Applications, the primary attack vectors exploit the elasticity and event-driven nature of cloud functions:

2. Perimeter Defense: Hardening with AWS WAF and API Gateway

The first line of defense in a zero-trust serverless architecture is terminating malicious traffic at the CloudFront or API Gateway edge before a single compute millisecond is billed.

flowchart LR
    A[Client Request] --> B[AWS WAF WebACL]
    B -- Block 403 --> C[Rate Limit / SQLi / Bad Bots Blocked]
    B -- Allow --> D[Amazon API Gateway]
    D --> E[Lambda Authorizer / JWT Validation]
    E --> F[AWS Lambda Core Handler]
    F --> G[(Amazon DynamoDB)]

Essential AWS WAF Rule Sets for Serverless APIs

1. Rate-Based Denial of Wallet Protection: Restrict individual IP addresses to a maximum number of requests (e.g., 2,000 requests per 5-minute rolling window). This prevents automated bots from triggering millions of downstream Lambda executions.
2. AWS Managed Rules Common Rule Set (CRS): Automatically filters common web exploits including directory traversal, OS command injection, and high-entropy request anomalies.
3. Known Bad Inputs and SQL Injection (SQLi) Rule Sets: Inspects URI query strings, headers, and HTTP request bodies for malicious injection syntax before traffic reaches downstream compute runtimes.
4. Geo-Blocking & IP Reputation: Blocks known anonymizing proxies, Tor exit nodes, and traffic originating from regions outside your company’s operational perimeter.

3. Infrastructure as Code: AWS CDK TypeScript Blueprint

Hardening should never be configured manually in the AWS Console. Security must be declared as immutable Infrastructure as Code (IaC). Below is a production-grade AWS CDK (TypeScript) construct provisioning an API Gateway protected by an AWS WAF WebACL with least-privilege IAM scoping:

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import * as apigateway from 'aws-cdk-lib/aws-apigateway';
import * as wafv2 from 'aws-cdk-lib/aws-wafv2';
import * as iam from 'aws-cdk-lib/aws-iam';
import * as path from 'path';

export class HardenedServerlessApiStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // 1. Least-Privilege IAM Execution Role for Lambda
    const apiHandlerRole = new iam.Role(this, 'ApiHandlerExecutionRole', {
      assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
      description: 'Strict least-privilege role for API processing',
    });

    // CloudWatch Logs strictly scoped to this function's log group
    apiHandlerRole.addToPolicy(
      new iam.PolicyStatement({
        actions: ['logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents'],
        resources: [`arn:aws:logs:${this.region}:${this.account}:log-group:/aws/lambda/HardenedApiHandler:*`],
      })
    );

    // DynamoDB access scoped strictly to specific table ARN
    apiHandlerRole.addToPolicy(
      new iam.PolicyStatement({
        actions: ['dynamodb:GetItem', 'dynamodb:PutItem', 'dynamodb:UpdateItem'],
        resources: [`arn:aws:dynamodb:${this.region}:${this.account}:table/TijikiSecureOrders`],
      })
    );

    // 2. Hardened Lambda Function
    const apiFunction = new lambda.Function(this, 'HardenedApiFunction', {
      functionName: 'HardenedApiHandler',
      runtime: lambda.Runtime.NODEJS_20_X,
      handler: 'index.handler',
      code: lambda.Code.fromAsset(path.join(__dirname, '../dist')),
      role: apiHandlerRole,
      memorySize: 512,
      timeout: cdk.Duration.seconds(10),
      tracing: lambda.Tracing.ACTIVE, // AWS X-Ray distributed tracing
      environment: {
        NODE_OPTIONS: '--enable-source-maps',
        AWS_NODEJS_CONNECTION_REUSE_ENABLED: '1',
      },
    });

    // 3. REST API Gateway with validation and access logging
    const api = new apigateway.RestApi(this, 'ProtectedRestApi', {
      restApiName: 'ProtectedServerlessAPI',
      deployOptions: {
        stageName: 'prod',
        tracingEnabled: true,
        metricsEnabled: true,
      },
    });

    const integration = new apigateway.LambdaIntegration(apiFunction);
    api.root.addResource('orders').addMethod('POST', integration);

    // 4. AWS WAF WebACL Protection
    const webAcl = new wafv2.CfnWebACL(this, 'ServerlessApiWebAcl', {
      defaultAction: { allow: {} },
      scope: 'REGIONAL',
      visibilityConfig: {
        cloudWatchMetricsEnabled: true,
        metricName: 'ServerlessApiWebAclMetrics',
        sampledRequestsEnabled: true,
      },
      rules: [
        // Rate-limiting: Max 2000 requests per 5 minutes per IP
        {
          name: 'RateLimitRule',
          priority: 1,
          action: { block: {} },
          statement: {
            rateBasedStatement: {
              limit: 2000,
              aggregateKeyType: 'IP',
            },
          },
          visibilityConfig: {
            cloudWatchMetricsEnabled: true,
            metricName: 'RateLimitMetric',
            sampledRequestsEnabled: true,
          },
        },
        // AWS Managed Common Rule Set
        {
          name: 'AWSManagedRulesCommonRuleSet',
          priority: 2,
          overrideAction: { none: {} },
          statement: {
            managedRuleGroupStatement: {
              vendorName: 'AWS',
              name: 'AWSManagedRulesCommonRuleSet',
            },
          },
          visibilityConfig: {
            cloudWatchMetricsEnabled: true,
            metricName: 'AWSCommonRulesMetric',
            sampledRequestsEnabled: true,
          },
        },
      ],
    });

    // 5. Associate WAF WebACL to API Gateway Stage
    const stageArn = `arn:aws:apigateway:${this.region}::/restapis/${api.restApiId}/stages/prod`;
    new wafv2.CfnWebACLAssociation(this, 'WebAclAssociation', {
      resourceArn: stageArn,
      webAclArn: webAcl.attrArn,
    });
  }
}

4. Zero-Trust Runtime Validation inside AWS Lambda

Edge WAF protection must be complemented with defense-in-depth inside the function runtime. Never trust that a request is authenticated simply because it bypassed the edge. Validate cryptographic claims and sanitize incoming payloads using structured TypeScript guards:

import { APIGatewayProxyEvent, APIGatewayProxyResult } from 'aws-lambda';
import { z } from 'zod';

const SecureOrderPayloadSchema = z.object({
  customerId: z.string().uuid(),
  sku: z.string().regex(/^[A-Z0-9_-]{4,20}$/, 'Invalid SKU format'),
  quantity: z.number().int().min(1).max(50),
});

export const handler = async (event: APIGatewayProxyEvent): Promise<APIGatewayProxyResult> => {
  // 1. Enforce Mandatory Security Headers
  const contentType = event.headers['content-type'] || event.headers['Content-Type'];
  if (!contentType || !contentType.includes('application/json')) {
    return {
      statusCode: 415,
      body: JSON.stringify({ error: 'Unsupported Media Type: application/json required' }),
    };
  }

  // 2. Validate Claims from API Gateway Cognito/Custom Authorizer
  const callerClaims = event.requestContext.authorizer?.claims;
  if (!callerClaims || !callerClaims.sub) {
    return {
      statusCode: 401,
      body: JSON.stringify({ error: 'Unauthorized: Missing verified token claims' }),
    };
  }

  try {
    const body = JSON.parse(event.body || '{}');
    const validatedOrder = SecureOrderPayloadSchema.parse(body);

    // 3. Broken Object-Level Authorization (BOLA) Check
    // Verify that the authenticated caller identity matches the requested customerId
    if (callerClaims.sub !== validatedOrder.customerId) {
      console.warn(`[SECURITY ALERT] BOLA attempt: User ${callerClaims.sub} tried ordering for ${validatedOrder.customerId}`);
      return {
        statusCode: 403,
        body: JSON.stringify({ error: 'Forbidden: Cannot access resources for another tenant' }),
      };
    }

    // Process secure business logic...
    return {
      statusCode: 201,
      headers: {
        'Content-Type': 'application/json',
        'X-Content-Type-Options': 'nosniff',
        'Cache-Control': 'no-store',
      },
      body: JSON.stringify({ status: 'ACCEPTED', orderId: crypto.randomUUID() }),
    };

  } catch (err: any) {
    if (err instanceof z.ZodError) {
      return {
        statusCode: 422,
        body: JSON.stringify({ error: 'Payload Validation Failed', details: err.errors }),
      };
    }

    return {
      statusCode: 500,
      body: JSON.stringify({ error: 'Internal Server Error' }),
    };
  }
};

5. FinOps Analysis: The ROI of AWS WAF

Is deploying AWS WAF worth the recurring cloud cost for startups and mid-market companies?

The Financial Cost of Running AWS WAF

• WebACL Base Cost: $5.00 USD / month.
• Rules Cost: 2 Managed Rules + 1 Custom Rate Rule = 3 rules × $1.00 = $3.00 USD / month.
• Request Traffic Cost: $0.60 per 1,000,000 requests processed.
• Monthly Budget for 10M Requests: $5.00 + $3.00 + (10 × $0.60) = ~$14.00 USD / month.

The Financial Risk of an Unprotected API (Denial of Wallet)

Consider an unprotected API targeted by an unauthenticated layer 7 bot sending 50,000 requests per minute (~830 RPS) for 72 hours:

• Total rogue requests: 216,000,000 invocations.
• Lambda compute cost (512MB @ 250ms): ~$450.00 USD.
• API Gateway processing cost: ~$216.00 USD.
• Downstream DynamoDB or third-party API API quota exhaustion: Thousands of dollars in third-party overages and degraded service for legitimate paying customers.

The Architect’s Verdict: Spending $14.00/month on AWS WAF is the highest ROI cloud insurance an engineering organization can purchase.

Critical Antipatterns and Architectural Traps

1. The Blanket Wildcard IAM Trap

Assigning Resource: "*" to Lambda execution roles because configuring granular ARNs during development feels tedious.

• The Vulnerability: If any third-party npm dependency compromised via a supply chain attack executes inside the function, it can read all S3 buckets, list Secrets Manager keys, or drop databases across your account.
• The Remedy: Never use wildcard resources for state-altering actions. Restrict permissions to the exact table, bucket, or queue ARN.

2. Storing Secrets in Lambda Environment Variables

Placing database passwords, Stripe secret keys, or third-party tokens directly in plain text in Lambda environment variables.

• The Vulnerability: Environment variables are visible in plaintext to any developer or CI/CD runner with lambda:GetFunction permissions, and are frequently printed to CloudWatch during uncaught error logging.
• The Remedy: Fetch secrets at runtime using AWS Parameters and Secrets Lambda Extension, which caches secrets in memory with automatic rotation.

Frequently Asked Questions (FAQ)

Does AWS WAF add latency to Serverless APIs?

AWS WAF introduces negligible latency, typically between 0.5ms and 2.5ms, because inspection occurs at the AWS edge network before request payloads are handed off to API Gateway or Lambda.

What is the difference between an API Gateway Lambda Authorizer and AWS WAF?

AWS WAF inspects traffic at layers 3, 4, and 7 to prevent DDoS, SQL injection, and volumetric abuse based on IP and payload signatures. A Lambda Authorizer verifies application-level identity (JWT tokens, OAuth2 scopes, session claims) after WAF has validated that the traffic is legitimate.

How do I protect Serverless APIs from Broken Object-Level Authorization (BOLA)?

WAF cannot prevent BOLA because requests appear syntactically valid. BOLA must be prevented at the application layer by cryptographically binding the authenticated identity (sub or tenant_id from the JWT) against the requested database entity key before executing reads or updates.

Conclusion & Security Health Check

True cloud resilience is achieved by designing systems that assume breach at every boundary. By combining AWS WAF perimeter rate limiting, least-privilege IAM execution roles, and runtime Zod contract validation, your engineering organization can innovate at lightning speed while ensuring enterprise-grade compliance and security.

🛠️ Concerned about serverless API security or escalating AWS costs?

At Tijiki, our senior security and cloud architects conduct comprehensive zero-trust audits, harden IAM boundaries, and configure automated WAF protection.

👉 Book a Free 30-Minute Cloud Architecture & FinOps Diagnostic Session