Distributed Cloud Firewall for Serverless Resources (Early Access)

DCF for Serverless Resources is Early Access in 9.0. To request Early Access, contact your Aviatrix account team.

Distributed Cloud Firewall (DCF) extends network security controls to serverless compute on AWS, GCP, and Azure. You can apply egress policies to serverless resources by adding them to SmartGroups, the same way you do with VMs and other cloud resources. A serverless resource must be attached to a VPC or VNet before DCF can apply policy to it. The Aviatrix Cloud Asset Inventory discovers eligible serverless resources from your onboarded cloud accounts and makes them available for SmartGroup membership.

Supported Serverless Resource Types

Cloud Provider	Resource Type	Serverless Type Value
AWS	Lambda functions	`LAMBDA`
AWS	ECS tasks (including Fargate)	`ECS`
GCP	Cloud Functions (1st gen)	`CLOUD_FUNCTION`
GCP	Cloud Run services	`CLOUD_RUN`
Azure	Function Apps	`AZURE_FUNCTIONS`
Azure	Container Apps	`AZURE_CONTAINER_APPS`

GCP Cloud Functions v2 are not separately inventoried. They appear in the Cloud Run services inventory as CLOUD_RUN type.

Prerequisites

Aviatrix Controller 9.0 or later.
DCF enabled.
Each serverless resource has VPC or VNet attachment configured. See the next section for the configuration each resource type needs.
An Aviatrix gateway in the same VPC/VNet, or in a peered network where traffic can be inspected.

Required Network Configuration per Resource Type

Resource Type	Required Configuration
AWS Lambda	VPC configuration enabled with a VPC ID and one or more subnet IDs.
AWS ECS / Fargate	Task running in a VPC with an associated network interface.
GCP Cloud Functions v1	VPC Access Connector attached to the function.
GCP Cloud Run	VPC Access Connector or direct VPC access through network interfaces.
Azure Function Apps	VNet integration enabled with a virtual network subnet ID.
Azure Container Apps	Managed environment deployed with VNet configuration and an infrastructure subnet.

Serverless resources without VPC or VNet attachment are not visible to the Cloud Asset Inventory and cannot be targeted by DCF policy.

How It Works

When you onboard a cloud account, the Cloud Asset Inventory discovers serverless resources from the cloud provider APIs and adds them to the inventory alongside VMs, VPCs, and other cloud assets. For each serverless resource, the inventory records the network interfaces or subnet CIDRs that DCF uses for policy enforcement:

AWS Lambda and ECS: the network interfaces created by the cloud provider in your VPC are inventoried. Each function has its own interfaces that persist even when the function scales to zero. DCF applies policy using the private IPs of these interfaces.
GCP Cloud Functions and Cloud Run: the VPC Access Connector or direct VPC access configuration is recorded. DCF applies policy using the connector’s IP CIDR or the subnet CIDR.
Azure Function Apps and Container Apps: the VNet integration subnet is recorded. DCF applies policy using the subnet CIDR or the static IP of the managed environment’s internal load balancer.

After a serverless resource is discovered, you can add it to a SmartGroup and apply DCF rules to its traffic.

Create a SmartGroup for Serverless Resources

SmartGroups for serverless resources use type = "serverless" as the required match expression. You can scope a SmartGroup to specific resource types, regions, accounts, names, or tags.

Using Terraform

resource "aviatrix_smart_group" "payment_lambdas" {
  name = "payment-lambdas"
  selector {
    match_expressions {
      type            = "serverless"
      serverless_type = "LAMBDA"
      region          = "us-east-1"
      tags = {
        env = "production"
      }
    }
  }
}

You can add multiple match_expressions blocks within a single selector to OR across different serverless types or accounts.

SmartGroup Filter Parameters

Parameter	Description	Example
`type`	Required. Must be `serverless`.	`serverless`
`serverless_type`	Filters by serverless resource subtype.	`LAMBDA`, `ECS`, `CLOUD_FUNCTION`, `CLOUD_RUN`, `AZURE_FUNCTIONS`, `AZURE_CONTAINER_APPS`
`name`	Matches by function or service name.	`my-payment-function`
`region`	Matches resources in a cloud region.	`us-east-1`
`account_name`	Matches resources in a cloud account.	`aws-prod`
`res_id`	Matches a single resource by cloud resource ID.	`arn:aws:lambda:us-east-1:123456789012:function:my-fn`
`tags.<key>`	Matches by a specific tag key-value pair.	`tags.env = production`

Combine multiple attributes within one match expression to AND conditions. Add multiple match expressions to OR across different serverless types or accounts.

Examples

Match all Lambda functions in a region:

type            = serverless
serverless_type = LAMBDA
region          = us-east-1

Match Azure Container Apps by tag:

type            = serverless
serverless_type = AZURE_CONTAINER_APPS
tags.env        = production

Match all serverless resources in a specific account:

type         = serverless
account_name = aws-prod

Policy Enforcement Behavior

When a serverless resource is in a SmartGroup used by a DCF rule, Aviatrix picks the enforcement addresses based on the resource type:

Enforcement Method	Applies To	Details
NIC private IP addresses	AWS Lambda, AWS ECS, Azure Container Apps	Policy uses the private IPs of the network interfaces in your VPC/VNet.
Subnet CIDR	GCP Cloud Functions, GCP Cloud Run, Azure Function Apps	Policy uses the CIDR of the subnet or VPC Access Connector the resource is attached to.

DCF only filters egress (outbound) traffic from serverless resources. Ingress traffic filtering is not supported because incoming requests are routed through the cloud provider’s internal infrastructure.

Limitations

Early Access: This feature is in Early Access in 9.0. SmartGroup serverless support is configurable through Terraform; CoPilot UI scope for serverless SmartGroup creation is limited in this release.
Serverless resources without VPC or VNet attachment are not discoverable by the Cloud Asset Inventory.
Azure Container Apps are enforced using the static IP of the managed environment’s internal load balancer, which may fall outside the subnet CIDR if the IP space is exhausted.
On AWS, if two or more Lambda functions share the same subnet and security group, they may share the same network interface. The inventory associates each interface with a single function.
Policy enforcement requires an Aviatrix gateway in the same VPC/VNet or in a peered network where traffic can be inspected.

Concepts & Architecture

Guides

Reference

Distributed Cloud Firewall for Serverless Resources (Early Access)

Supported Serverless Resource Types

Prerequisites

Required Network Configuration per Resource Type

How It Works

Create a SmartGroup for Serverless Resources

Using Terraform

SmartGroup Filter Parameters

Examples

Policy Enforcement Behavior

Limitations

​Supported Serverless Resource Types

​Prerequisites

​Required Network Configuration per Resource Type

​How It Works

​Create a SmartGroup for Serverless Resources

​Using Terraform

​SmartGroup Filter Parameters

​Examples

​Policy Enforcement Behavior

​Limitations

​Related Topics

Supported Serverless Resource Types

Prerequisites

Required Network Configuration per Resource Type

How It Works

Create a SmartGroup for Serverless Resources

Using Terraform

SmartGroup Filter Parameters

Examples

Policy Enforcement Behavior

Limitations

Related Topics