How to Secure AWS Lambda 2026 Functions with Snyk 1.1200 and AWS IAM Roles Anywhere

// Import required dependencies for AWS Lambda 2026 Node.js 22.x runtime
import { SnykLambdaAgent } from '@snyk/lambda-agent/1.1200';
import { DynamoDBClient, PutItemCommand } from '@aws-sdk/client-dynamodb';
import { CloudWatchLogsClient, PutLogEventsCommand } from '@aws-sdk/client-cloudwatch-logs';
import { v4 as uuidv4 } from 'uuid';

// Initialize Snyk agent with 1.1200-specific configuration
// Enable runtime vulnerability scanning for dependencies loaded after cold start
const snykAgent = new SnykLambdaAgent({
  apiKey: process.env.SNYK_API_KEY, // Stored in AWS Secrets Manager, not hardcoded
  orgId: process.env.SNYK_ORG_ID,
  runtime: 'nodejs22.x',
  scanOnInvoke: true, // Scan dependencies on every function invocation
  failOnHighSeverity: true, // Throw error if CVSS ≥ 7.0 vulns found
  logLevel: 'info',
  ignorePaths: ['/var/runtime', '/opt/nodejs/node_modules/aws-sdk'], // Skip AWS managed deps
});

// Initialize AWS SDK clients with IAM Roles Anywhere credentials (covered later)
const dynamoClient = new DynamoDBClient({ region: process.env.AWS_REGION });
const logsClient = new CloudWatchLogsClient({ region: process.env.AWS_REGION });

// Lambda handler with Snyk scanning and error handling
export const handler = async (event, context) => {
  // Log invocation start to CloudWatch
  const invocationId = uuidv4();
  const startTime = Date.now();

  try {
    // Trigger Snyk runtime scan before processing event
    // This scans all require/import calls made during this invocation
    const scanResult = await snykAgent.scan({
      invocationId,
      functionArn: context.invokedFunctionArn,
      eventType: event?.type || 'unknown',
    });

    // Check for high-severity vulnerabilities
    const highSeverityVulns = scanResult.vulnerabilities.filter(
      (vuln) => vuln.cvssScore >= 7.0
    );

    if (highSeverityVulns.length > 0) {
      // Log critical vulnerability alert to CloudWatch
      await logSecurityEvent({
        invocationId,
        eventType: 'HIGH_SEVERITY_VULN',
        vulns: highSeverityVulns.map((v) => ({
          id: v.id,
          package: v.packageName,
          version: v.packageVersion,
          cvss: v.cvssScore,
        })),
        timestamp: new Date().toISOString(),
      });

      // Fail invocation if high-severity vulns found (configurable)
      throw new Error(
        `High severity vulnerabilities detected: ${highSeverityVulns.map((v) => v.id).join(', ')}`
      );
    }

    // Process valid event (sample: store item to DynamoDB)
    const item = {
      id: { S: invocationId },
      eventType: { S: event?.type || 'unknown' },
      timestamp: { S: new Date().toISOString() },
      snykScanId: { S: scanResult.scanId },
    };

    const putCommand = new PutItemCommand({
      TableName: process.env.DYNAMO_TABLE_NAME,
      Item: item,
    });

    await dynamoClient.send(putCommand);

    // Log successful invocation
    await logSecurityEvent({
      invocationId,
      eventType: 'INVOCATION_SUCCESS',
      scanId: scanResult.scanId,
      durationMs: Date.now() - startTime,
      timestamp: new Date().toISOString(),
    });

    return {
      statusCode: 200,
      body: JSON.stringify({
        message: 'Event processed successfully',
        invocationId,
        snykScanId: scanResult.scanId,
      }),
    };
  } catch (error) {
    // Log error to CloudWatch with Snyk context if available
    await logSecurityEvent({
      invocationId,
      eventType: 'INVOCATION_ERROR',
      error: error.message,
      snykContext: error.snykMetadata || null,
      timestamp: new Date().toISOString(),
    });

    return {
      statusCode: error.statusCode || 500,
      body: JSON.stringify({
        error: error.message,
        invocationId,
      }),
    };
  }
};

// Helper function to log structured security events to CloudWatch
const logSecurityEvent = async (event) => {
  try {
    const logStreamName = `snyk-lambda-security/${new Date().toISOString().split('T')[0]}`;
    const logEvents = [
      {
        timestamp: BigInt(Date.now()),
        message: JSON.stringify(event),
      },
    ];

    const putLogCommand = new PutLogEventsCommand({
      logGroupName: '/aws/lambda/snyk-security-logs',
      logStreamName,
      logEvents,
    });

    await logsClient.send(putLogCommand);
  } catch (logError) {
    // Swallow logging errors to avoid recursive failure, but print to stdout for Lambda logs
    console.error('Failed to log security event:', logError.message);
  }
};

// Initialize Snyk agent on cold start (runs once per Lambda instance)
snykAgent.init().catch((initError) => {
  console.error('Snyk agent initialization failed:', initError.message);
  // Terminate Lambda instance if Snyk agent fails to init (configurable)
  process.exit(1);
});

// AWS IAM Roles Anywhere Setup Script for Lambda 2026 Functions
// Requires AWS SDK v3, @aws-sdk/client-iam, @aws-sdk/client-rolesanywhere
// Run with: node setup-iam-roles-anywhere.mjs --region us-east-1 --lambda-role-name snyk-lambda-role
import { IAMClient, CreateRoleCommand, AttachRolePolicyCommand, GetRoleCommand } from '@aws-sdk/client-iam';
import {
  RolesAnywhereClient,
  CreateTrustAnchorCommand,
  CreateProfileCommand,
  CreateCredentialLibraryCommand,
  ListTrustAnchorsCommand,
  ListProfilesCommand,
  ListCredentialLibrariesCommand,
} from '@aws-sdk/client-rolesanywhere';
import { readFileSync } from 'fs';
import { parseArgs } from 'util';

// Parse command line arguments
const { values } = parseArgs({
  options: {
    region: { type: 'string', default: 'us-east-1' },
    lambdaRoleName: { type: 'string', default: 'snyk-lambda-exec-role' },
    trustAnchorCertPath: { type: 'string', default: './trust-anchor-cert.pem' },
    profileDurationSeconds: { type: 'number', default: 900 }, // 15 minutes, max for IAM Roles Anywhere
  },
});

// Initialize AWS clients
const iamClient = new IAMClient({ region: values.region });
const rolesAnywhereClient = new RolesAnywhereClient({ region: values.region });

// Load trust anchor certificate (self-signed or CA-issued for hybrid environments)
let trustAnchorCert;
try {
  trustAnchorCert = readFileSync(values.trustAnchorCertPath, 'utf8');
} catch (certError) {
  console.error(`Failed to load trust anchor certificate: ${certError.message}`);
  process.exit(1);
}

// Step 1: Create IAM Role for Lambda with minimal permissions
const createLambdaRole = async () => {
  const assumeRolePolicy = JSON.stringify({
    Version: '2012-10-17',
    Statement: [
      {
        Effect: 'Allow',
        Principal: { Service: 'lambda.amazonaws.com' },
        Action: 'sts:AssumeRole',
      },
      {
        Effect: 'Allow',
        Principal: { Service: 'rolesanywhere.amazonaws.com' },
        Action: 'sts:AssumeRole',
        Condition: {
          StringEquals: {
            'aws:SourceAccount': process.env.AWS_ACCOUNT_ID,
          },
        },
      },
    ],
  });

  try {
    const createRoleCommand = new CreateRoleCommand({
      RoleName: values.lambdaRoleName,
      AssumeRolePolicyDocument: assumeRolePolicy,
      Description: 'IAM Role for Lambda 2026 functions with Snyk and IAM Roles Anywhere access',
    });

    const roleResponse = await iamClient.send(createRoleCommand);
    console.log(`Created IAM Role: ${roleResponse.Role.Arn}`);

    // Attach required managed policies
    const managedPolicies = [
      'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole',
      'arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess', // For 2026 Lambda tracing
    ];

    for (const policyArn of managedPolicies) {
      await iamClient.send(
        new AttachRolePolicyCommand({
          RoleName: values.lambdaRoleName,
          PolicyArn: policyArn,
        })
      );
      console.log(`Attached policy ${policyArn} to role ${values.lambdaRoleName}`);
    }

    return roleResponse.Role.Arn;
  } catch (roleError) {
    if (roleError.name === 'EntityAlreadyExists') {
      console.log(`Role ${values.lambdaRoleName} already exists, fetching ARN...`);
      const getRoleResponse = await iamClient.send(
        new GetRoleCommand({ RoleName: values.lambdaRoleName })
      );
      return getRoleResponse.Role.Arn;
    }
    throw roleError;
  }
};

// Step 2: Create IAM Roles Anywhere Trust Anchor
const createTrustAnchor = async (roleArn) => {
  try {
    const trustAnchorCommand = new CreateTrustAnchorCommand({
      name: 'lambda-hybrid-trust-anchor',
      certificate: trustAnchorCert,
      source: { X509CertificateAuthority: {} },
      tags: [{ key: 'purpose', value: 'lambda-snyk-security' }],
    });

    const trustAnchorResponse = await rolesAnywhereClient.send(trustAnchorCommand);
    console.log(`Created Trust Anchor: ${trustAnchorResponse.trustAnchor.arn}`);
    return trustAnchorResponse.trustAnchor.arn;
  } catch (trustAnchorError) {
    if (trustAnchorError.name === 'ResourceAlreadyExistsException') {
      console.log('Trust anchor already exists, fetching ARN...');
      const listResponse = await rolesAnywhereClient.send(new ListTrustAnchorsCommand({}));
      const existingAnchor = listResponse.trustAnchors.find(
        (anchor) => anchor.name === 'lambda-hybrid-trust-anchor'
      );
      return existingAnchor?.arn;
    }
    throw trustAnchorError;
  }
};

// Step 3: Create IAM Roles Anywhere Profile
const createRolesAnywhereProfile = async (roleArn, trustAnchorArn) => {
  try {
    const profileCommand = new CreateProfileCommand({
      name: 'lambda-snyk-profile',
      roleArns: [roleArn],
      durationSeconds: values.profileDurationSeconds,
      tags: [{ key: 'purpose', value: 'lambda-snyk-security' }],
    });

    const profileResponse = await rolesAnywhereClient.send(profileCommand);
    console.log(`Created Roles Anywhere Profile: ${profileResponse.profile.arn}`);
    return profileResponse.profile.arn;
  } catch (profileError) {
    if (profileError.name === 'ResourceAlreadyExistsException') {
      console.log('Profile already exists, fetching ARN...');
      const listResponse = await rolesAnywhereClient.send(new ListProfilesCommand({}));
      const existingProfile = listResponse.profiles.find(
        (profile) => profile.name === 'lambda-snyk-profile'
      );
      return existingProfile?.arn;
    }
    throw profileError;
  }
};

// Step 4: Create Credential Library for Lambda to use IAM Roles Anywhere
const createCredentialLibrary = async (trustAnchorArn, profileArn) => {
  try {
    const credLibraryCommand = new CreateCredentialLibraryCommand({
      name: 'lambda-snyk-cred-library',
      trustAnchorArn,
      profileArn,
      credentialType: 'AWS_STS_CREDENTIALS',
      tags: [{ key: 'purpose', value: 'lambda-snyk-security' }],
    });

    const credLibraryResponse = await rolesAnywhereClient.send(credLibraryCommand);
    console.log(`Created Credential Library: ${credLibraryResponse.credentialLibrary.arn}`);
    return credLibraryResponse.credentialLibrary.arn;
  } catch (credError) {
    if (credError.name === 'ResourceAlreadyExistsException') {
      console.log('Credential library already exists, fetching ARN...');
      const listResponse = await rolesAnywhereClient.send(new ListCredentialLibrariesCommand({}));
      const existingLib = listResponse.credentialLibraries.find(
        (lib) => lib.name === 'lambda-snyk-cred-library'
      );
      return existingLib?.arn;
    }
    throw credError;
  }
};

// Main execution flow
(async () => {
  try {
    console.log('Starting IAM Roles Anywhere setup for Lambda 2026...');
    const lambdaRoleArn = await createLambdaRole();
    const trustAnchorArn = await createTrustAnchor(lambdaRoleArn);
    const profileArn = await createRolesAnywhereProfile(lambdaRoleArn, trustAnchorArn);
    const credLibraryArn = await createCredentialLibrary(trustAnchorArn, profileArn);

    console.log('\nSetup complete! Use the following ARNs in your Lambda configuration:');
    console.log(`Lambda Role ARN: ${lambdaRoleArn}`);
    console.log(`Trust Anchor ARN: ${trustAnchorArn}`);
    console.log(`Profile ARN: ${profileArn}`);
    console.log(`Credential Library ARN: ${credLibraryArn}`);
    console.log('\nConfigure your Lambda function to use the credential library for passwordless auth.');
  } catch (error) {
    console.error('Setup failed:', error.message);
    process.exit(1);
  }
})();

# GitHub Actions Workflow for Securing Lambda 2026 with Snyk 1.1200 and IAM Roles Anywhere
# Save to .github/workflows/secure-lambda-deploy.yml
name: Secure Lambda Deploy

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

env:
  AWS_REGION: us-east-1
  SNYK_ORG_ID: ${{ secrets.SNYK_ORG_ID }}
  SNYK_API_KEY: ${{ secrets.SNYK_API_KEY }}
  LAMBDA_RUNTIME: nodejs22.x
  SNYK_VERSION: 1.1200

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js 22.x (matches Lambda 2026 runtime)
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: 'npm'

      - name: Install dependencies
        run: npm ci --ignore-scripts # Skip build scripts to avoid false positives

      - name: Install Snyk 1.1200 CLI
        run: |
          npm install -g snyk@${SNYK_VERSION}
          snyk --version # Verify installed version
          if [ "$(snyk --version | cut -d' ' -f1)" != "${SNYK_VERSION}" ]; then
            echo "Snyk version mismatch. Expected ${SNYK_VERSION}"
            exit 1
          fi

      - name: Authenticate Snyk
        run: snyk auth ${SNYK_API_KEY}

      - name: Snyk Lambda 2026 Runtime Scan
        # Snyk 1.1200 adds --lambda-runtime flag for 2026 runtimes
        run: |
          snyk test \
            --org=${SNYK_ORG_ID} \
            --lambda-runtime=${LAMBDA_RUNTIME} \
            --severity-threshold=high \ # Fail on CVSS ≥7.0
            --json > snyk-results.json

      - name: Upload Snyk Results to GitHub Security Tab
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: snyk-results.json

      - name: Fail build on high-severity vulnerabilities
        run: |
          HIGH_VULNS=$(cat snyk-results.json | jq '.vulnerabilities | map(select(.cvssScore >=7.0)) | length')
          if [ "$HIGH_VULNS" -gt 0 ]; then
            echo "High severity vulnerabilities detected: $HIGH_VULNS"
            exit 1
          fi

  deploy-lambda:
    needs: security-scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Configure AWS Credentials via IAM Roles Anywhere
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-arn: ${{ secrets.LAMBDA_ROLE_ARN }}
          role-session-name: github-actions-lambda-deploy
          trust-anchor-arn: ${{ secrets.IAM_ROLES_ANYWHERE_TRUST_ANCHOR_ARN }}
          profile-arn: ${{ secrets.IAM_ROLES_ANYWHERE_PROFILE_ARN }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Setup Node.js 22.x
        uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Install dependencies and build
        run: |
          npm ci
          npm run build # Compile TypeScript to JavaScript for Lambda

      - name: Package Lambda function
        run: |
          zip -r lambda-function.zip dist/ node_modules/ package.json

      - name: Deploy Lambda function
        uses: aws-actions/aws-lambda-deploy@v3
        with:
          function-name: snyk-secured-lambda-2026
          zip-file: lambda-function.zip
          runtime: ${{ env.LAMBDA_RUNTIME }}
          role: ${{ secrets.LAMBDA_ROLE_ARN }}
          environment: |
            SNYK_API_KEY=${{ secrets.SNYK_API_KEY }}
            SNYK_ORG_ID=${{ secrets.SNYK_ORG_ID }}
            AWS_REGION=${{ env.AWS_REGION }}

      - name: Verify Snyk Agent in Lambda
        run: |
          aws lambda invoke \
            --function-name snyk-secured-lambda-2026 \
            --payload '{"type":"test"}' \
            response.json
          cat response.json
          if [ $(cat response.json | jq '.snykScanId') = "null" ]; then
            echo "Snyk agent not initialized in Lambda"
            exit 1
          fi

// Cache Snyk scan results in Lambda /tmp directory
const crypto = require('crypto');
const fs = require('fs');
const path = require('path');

const getScanCacheKey = (deps) => {
  const depHash = crypto.createHash('sha256').update(JSON.stringify(deps)).digest('hex');
  return path.join('/tmp', `snyk-scan-${depHash}.json`);
};

const getCachedScan = async (cacheKey) => {
  try {
    if (fs.existsSync(cacheKey)) {
      const stats = fs.statSync(cacheKey);
      // Cache valid for 1 hour
      if (Date.now() - stats.mtimeMs < 3600000) {
        return JSON.parse(fs.readFileSync(cacheKey, 'utf8'));
      }
    }
    return null;
  } catch (cacheError) {
    console.error('Cache read error:', cacheError.message);
    return null;
  }
};

const setCachedScan = async (cacheKey, scanResult) => {
  try {
    fs.writeFileSync(cacheKey, JSON.stringify(scanResult));
  } catch (cacheError) {
    console.error('Cache write error:', cacheError.message);
  }
};

// Add session tags to IAM Roles Anywhere credentials
import { RolesAnywhereClient, AssumeRoleCommand } from '@aws-sdk/client-rolesanywhere';

const getRolesAnywhereCredentials = async (functionArn, invocationId, snykScanId) => {
  const client = new RolesAnywhereClient({ region: process.env.AWS_REGION });
  const command = new AssumeRoleCommand({
    roleArn: process.env.LAMBDA_ROLE_ARN,
    profileArn: process.env.IAM_ROLES_ANYWHERE_PROFILE_ARN,
    trustAnchorArn: process.env.IAM_ROLES_ANYWHERE_TRUST_ANCHOR_ARN,
    sessionTags: [
      { key: 'lambda-function-arn', value: functionArn },
      { key: 'invocation-id', value: invocationId },
      { key: 'snyk-scan-id', value: snykScanId },
      { key: 'environment', value: process.env.ENVIRONMENT || 'prod' },
    ],
    durationSeconds: 900,
  });

  try {
    const response = await client.send(command);
    return response.credentials;
  } catch (assumeError) {
    console.error('Failed to assume role via IAM Roles Anywhere:', assumeError.message);
    throw assumeError;
  }
};

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "daily"
    open-pull-requests-limit: 10
    target-branch: "main"
    reviewers:
      - "security-team"
    labels:
      - "dependencies"
      - "security"
    allow:
      - dependency-type: "production"
    ignore:
      - dependency-name: "aws-sdk"
        versions: ["< 3.600.0"] # Compatible with Lambda 2026 Node.js 22.x
      - dependency-name: "@snyk/lambda-agent"
        versions: ["< 1.1200"] # Require latest Snyk agent
    commit-message:
      prefix: "security"
      include: "scope"

lambda-2026-iam-roles-anywhere/
├── .github/
│   └── workflows/
│       └── secure-lambda-deploy.yml  # GitHub Actions workflow from code example 3
├── src/
│   ├── lambda/  # Lambda function code (code example 1)
│   │   ├── index.mjs
│   │   ├── package.json
│   │   └── snyk-agent-config.json
│   └── scripts/  # IAM Roles Anywhere setup script (code example 2)
│       ├── setup-iam-roles-anywhere.mjs
│       └── trust-anchor-cert.pem.example
├── terraform/  # Infrastructure as Code for AWS resources
│   ├── main.tf
│   └── variables.tf
├── .snyk  # Snyk ignore rules
├── package.json  # Root dependencies for CI/CD
└── README.md  # Setup instructions