How to secure a function

This page explains how to secure your function.

Before you start

To complete the actions presented below, you must have:

• A Scaleway account logged into the console
• Owner status or IAM permissions allowing you to perform actions in the intended Organization
• A functions namespace
• A function
• Created an authentication token for your function

Use secrets to store access keys and sensitive information

Instead of using environment variables (which are stored in clear text) for your functions, use secrets. These are pieces of information that can be used via environment variables, but are encrypted in storage.

Configure secrets from the Scaleway console

1. Click Functions in the Serverless section of the side menu. The functions page displays.
2. Click the relevant function namespace.
3. Click the name of the function for which you want to define secrets.
4. Click the Settings tab.
5. Scroll to the Secrets section of the page and click Add secret. Enter the key and value for your secret. Repeat for additional secrets.
   Important

   Be careful when you type your secrets. You will not be able to read the value in the console once submitted.

6. Click Save settings to submit your secrets and redeploy your function.

Configure secrets using the Serverless framework

Add secret to your function's description (more information in the plugin documentation). We recommend using them with global environment variables or a .env file stored independently (and kept secret).

secret:
      secret_1: ${env:SCW_SECRET_KEY}

Configure secrets using Terraform/OpenTofu

Add the following resource description in Terraform/OpenTofu:

secret_environment_variables = { "key" = "secret" }

Restrict access to your functions

You can set Serverless Functions as private if you want to protect your functions from unwanted or unauthorized calls.

Unauthenticated calls will be rejected, and your function will not be triggered. This feature is handy if an event triggers your function (CRON, Queues or NATS trigger) or if you put them behind an API gateway or a proxy server (see examples in serverless-examples).

Restrict access from the Scaleway console

1. Click Functions in the Serverless section of the side menu. The functions page displays.
2. Click the relevant function namespace.
3. Click the name of the function for which you want to define secrets.
4. Click the Security tab.
5. Set the Privacy Policy of the function to Private.
6. If required, set up IAM authentication for your function.

Your function is now private, and requires an X-Auth-Token header to be called:

curl -H "X-Auth-Token: <YOUR_SECRET_KEY>" <YOUR_FUNCTION_ENDPOINT>

Restrict access using the Serverless framework

Set privacy: private in your function's description.

Your function is now private, and requires an X-Auth-Token header to be called:

curl -H "X-Auth-Token: <YOUR_SECRET_KEY>" <YOUR_FUNCTION_ENDPOINT>

Refer to the How to manage authentication for private functions documentation for more information.

Restrict access using Terraform/OpenTofu

Set privacy = "private" in your Terraform/OpenTofu resource description.

You can generate access credentials to inject in other applications (containers, functions etc.) directly from Terraform/OpenTofu using the function_token resource.

Advanced access control with IAM conditions

When a function is set to Private, you can use Scaleway IAM policy conditions to define granular access rules using Common Expression Language (CEL): policy conditions documentation. These conditions use Common Expression Language (CEL) to evaluate requests based on attributes like IP address, time, or user-agent.

Restrict access by specific IP addresses

To ensure your function is only reachable from a specific office network or a trusted proxy, you can use the inIpRange() function.

Example expression:

inIpRange(request.ip, "198.51.100.0/24")

Result: Only requests originating from the 198.51.100.0/24 subnet are authorized.

Restrict access to specific user-agents

You can restrict calls to specific tools or internal clients by checking the request.user_agent attribute. This is useful for ensuring only authorized automation tools (like Terraform or a specific internal bot) can trigger the service.

Example expression:

request.user_agent.contains("InternalAdminTool/1.0")

Result: Only requests with a User-Agent header containing "InternalAdminTool/1.0" are permitted.

Restrict access to specific time windows

For sensitive workloads that should only be active during business hours or specific maintenance windows, you can use request.time.

Example expression (Working hours in Paris):

request.time.getDayOfWeek() != 0 && request.time.getDayOfWeek() != 6
&& request.time.getHours("Europe/Paris") >= 9
&& request.time.getHours("Europe/Paris") < 18

Result: Access is granted only Monday through Friday, between 9:00 AM and 6:00 PM Paris time.

Combine multiple security layers

You can use logical operators like && (AND) and || (OR) to build complex security requirements.

Example: Restrict to a specific IP OR a specific User-Agent during weekdays:

(inIpRange(request.ip, "203.0.113.42/32") || request.user_agent.contains("TrustedCI"))
&& request.time.getDayOfWeek() != 0 && request.time.getDayOfWeek() != 6

Result: The request is allowed if it comes from the trusted IP OR the trusted CI tool, but only on weekdays.

Set up alerts in Observability Cockpit (upcoming feature)

Using Scaleway Observability Cockpit, a managed Grafana solution to which all your functions are connected, you can:

• Monitor your functions using the default dashboard or create custom ones.
• Set up notifications to be alerted in case of unexpected behavior.