Jump toUpdate content

How to secure a function

Reviewed on 07 August 2023Published on 01 February 2023

This page explains how to secure your function.

Security & Identity (IAM):

You may need certain IAM permissions to carry out some actions described on this page. This means:

  • you are the Owner of the Scaleway Organization in which the actions will be carried out, or
  • you are an IAM user of the Organization, with a policy granting you the necessary permission sets
Requirements:

Use Secrets to store access keys and sensitive information

Instead of using environment variables (which are stored in clear text) for your functions, use Secrets. These are pieces of information that can be used via environment variables, but are encrypted in storage.

Tip:

You can create an API key and store it with Secrets to grant your functions access to the Scaleway API

Configure Secrets from the Scaleway console

  1. Click Functions in the Serverless section of the side menu. The functions page displays.
  2. Click the relevant function namespace.
  3. Click the name of the function for which you want to define Secrets.
  4. Click the Settings tab.
  5. Scroll to the Secrets section of the page and click Add new secret. Enter the key and value for your Secret. Repeat for additional secrets.
    Important:

    Be careful when you type your Secrets. You will not be able to read the value in the console once submitted.

  6. Click Save settings to submit your secrets and redeploy your function.

Configure Secrets using the Serverless framework

Add secret to your function’s description (more information in the plugin documentation). We recommend using them with global environment variables or a .env file stored independently (and kept secret).

secret:
secret_1: ${env:SCW_SECRET_KEY}
Important:

We strongly suggest that you do not commit this in a Version Control System (VCS), and do not share your Project ID or access key. This helps to ensure the security of your configuration file, which may contain sensitive data.

Configure Secrets using Terraform

Add the following resource description in Terraform:

secret_environment_variables = { "key" = "secret" }

Restrict access to your functions

You can set Serverless Functions as private if you want to protect your functions from unwanted or unauthorized calls. Unauthenticated calls will be rejected, and your function will not be triggered. This feature is handy if an event triggers your function (CRON, SQS or NATS trigger) or if you put them behind an API gateway or a proxy server (see examples in serverless-examples).

Restrict access from the Scaleway console

  1. Click Functions in the Serverless section of the side menu. The functions page displays.
  2. Click the relevant function namespace.
  3. Click the name of the function for which you want to define Secrets.
  4. Click the Security tab.
  5. Set the Privacy Policy of the function to Private.
  6. If required, create an access token for your function:
    • Click Generate token in the Tokens section of the page. A pop-up displays.
    • Enter a description and set an optional expiration date. To generate a permanently-valid valid token tick No expiration date. Then click Generate token.
    • The token is displayed. Copy and store the token in a secure environment.
      Important:

      The token key will be shown only once. Copy and safely store it before leaving this page.

Restrict access using the Serverless framework

Set privacy: private in your functions description.

You can generate access tokens for your function using the Scaleway console:

  1. Click Functions in the Serverless section of the side menu. The functions page displays.
  2. Click the relevant function namespace.
  3. Click the name of the function for which you want to define Secrets.
  4. Click the Security tab.
  5. Click Generate token in the Tokens section of the page. A pop-up displays.
  6. Enter a description and set an optional expiration date. To generate a permanently-valid valid token, tick No expiration date. Then click Generate token. The token is displayed. Copy and store the token in a secure environment.
    Important:

    The token key will be shown only once. Copy and safely store it before leaving this page.

Restrict access using Terraform

Set privacy = "private" in your Terraform resource description.

You can generate access credentials to inject in other applications (containers, functions etc.) directly from Terraform using the function_token resource

Set up alerts in Observability Cockpit (upcoming feature)

Using Scaleway Observability Cockpit, a managed Grafana solution to which all your functions are connected, you can:

  • Monitor your functions using the default dashboard or create custom ones.
  • Set up notifications to be alerted in case of unexpected behavior.
See Also