> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Distributed Cloud Firewall for Serverless Resources (Early Access)
> Aviatrix Distributed Cloud Firewall discovers serverless compute resources across AWS, GCP, and Azure, and lets you target them with SmartGroups by type, region, name, account, or tag.
DCF for Serverless Resources is **Early Access** in 9.0. To request Early
Access, contact your Aviatrix account team.
Distributed Cloud Firewall (DCF) extends network security controls to serverless
compute on AWS, GCP, and Azure. You can apply egress policies to serverless
resources by adding them to SmartGroups, the same way you do with VMs and other
cloud resources.
A serverless resource must be attached to a VPC or VNet before DCF can apply
policy to it. The Aviatrix Cloud Asset Inventory discovers eligible serverless
resources from your onboarded cloud accounts and makes them available for
SmartGroup membership.
## Supported Serverless Resource Types
| Cloud Provider | Resource Type | Serverless Type Value |
| -------------- | ----------------------------- | ---------------------- |
| AWS | Lambda functions | `LAMBDA` |
| AWS | ECS tasks (including Fargate) | `ECS` |
| GCP | Cloud Functions (1st gen) | `CLOUD_FUNCTION` |
| GCP | Cloud Run services | `CLOUD_RUN` |
| Azure | Function Apps | `AZURE_FUNCTIONS` |
| Azure | Container Apps | `AZURE_CONTAINER_APPS` |
GCP Cloud Functions v2 are not separately inventoried. They appear in the
Cloud Run services inventory as `CLOUD_RUN` type.
## Prerequisites
* Aviatrix Controller 9.0 or later.
* DCF enabled.
* Each serverless resource has VPC or VNet attachment configured. See the next
section for the configuration each resource type needs.
* An Aviatrix gateway in the same VPC/VNet, or in a peered network where traffic
can be inspected.
### Required Network Configuration per Resource Type
| Resource Type | Required Configuration |
| ---------------------- | ---------------------------------------------------------------------------------- |
| AWS Lambda | VPC configuration enabled with a VPC ID and one or more subnet IDs. |
| AWS ECS / Fargate | Task running in a VPC with an associated network interface. |
| GCP Cloud Functions v1 | VPC Access Connector attached to the function. |
| GCP Cloud Run | VPC Access Connector or direct VPC access through network interfaces. |
| Azure Function Apps | VNet integration enabled with a virtual network subnet ID. |
| Azure Container Apps | Managed environment deployed with VNet configuration and an infrastructure subnet. |
Serverless resources without VPC or VNet attachment are not visible to the
Cloud Asset Inventory and cannot be targeted by DCF policy.
## How It Works
When you onboard a cloud account, the Cloud Asset Inventory discovers serverless
resources from the cloud provider APIs and adds them to the inventory alongside
VMs, VPCs, and other cloud assets. For each serverless resource, the inventory
records the network interfaces or subnet CIDRs that DCF uses for policy
enforcement:
* AWS Lambda and ECS: the network interfaces created by the cloud provider in
your VPC are inventoried. Each function has its own interfaces that persist
even when the function scales to zero. DCF applies policy using the private
IPs of these interfaces.
* GCP Cloud Functions and Cloud Run: the VPC Access Connector or direct VPC
access configuration is recorded. DCF applies policy using the connector's IP
CIDR or the subnet CIDR.
* Azure Function Apps and Container Apps: the VNet integration subnet is
recorded. DCF applies policy using the subnet CIDR or the static IP of the
managed environment's internal load balancer.
After a serverless resource is discovered, you can add it to a SmartGroup and
apply DCF rules to its traffic.
## Create a SmartGroup for Serverless Resources
SmartGroups for serverless resources use `type = "serverless"` as the required
match expression. You can scope a SmartGroup to specific resource types,
regions, accounts, names, or tags.
### Using Terraform
```hcl theme={null}
resource "aviatrix_smart_group" "payment_lambdas" {
name = "payment-lambdas"
selector {
match_expressions {
type = "serverless"
serverless_type = "LAMBDA"
region = "us-east-1"
tags = {
env = "production"
}
}
}
}
```
You can add multiple `match_expressions` blocks within a single `selector` to OR
across different serverless types or accounts.
### SmartGroup Filter Parameters
| Parameter | Description | Example |
| ----------------- | ----------------------------------------------- | ----------------------------------------------------------------------------------------- |
| `type` | Required. Must be `serverless`. | `serverless` |
| `serverless_type` | Filters by serverless resource subtype. | `LAMBDA`, `ECS`, `CLOUD_FUNCTION`, `CLOUD_RUN`, `AZURE_FUNCTIONS`, `AZURE_CONTAINER_APPS` |
| `name` | Matches by function or service name. | `my-payment-function` |
| `region` | Matches resources in a cloud region. | `us-east-1` |
| `account_name` | Matches resources in a cloud account. | `aws-prod` |
| `res_id` | Matches a single resource by cloud resource ID. | `arn:aws:lambda:us-east-1:123456789012:function:my-fn` |
| `tags.` | Matches by a specific tag key-value pair. | `tags.env = production` |
Combine multiple attributes within one match expression to AND conditions. Add
multiple match expressions to OR across different serverless types or
accounts.
### Examples
Match all Lambda functions in a region:
```
type = serverless
serverless_type = LAMBDA
region = us-east-1
```
Match Azure Container Apps by tag:
```
type = serverless
serverless_type = AZURE_CONTAINER_APPS
tags.env = production
```
Match all serverless resources in a specific account:
```
type = serverless
account_name = aws-prod
```
## Policy Enforcement Behavior
When a serverless resource is in a SmartGroup used by a DCF rule, Aviatrix picks
the enforcement addresses based on the resource type:
| Enforcement Method | Applies To | Details |
| ------------------------ | ------------------------------------------------------- | --------------------------------------------------------------------------------------- |
| NIC private IP addresses | AWS Lambda, AWS ECS, Azure Container Apps | Policy uses the private IPs of the network interfaces in your VPC/VNet. |
| Subnet CIDR | GCP Cloud Functions, GCP Cloud Run, Azure Function Apps | Policy uses the CIDR of the subnet or VPC Access Connector the resource is attached to. |
DCF only filters egress (outbound) traffic from serverless resources. Ingress
traffic filtering is not supported because incoming requests are routed
through the cloud provider's internal infrastructure.
## Limitations
* **Early Access**: This feature is in Early Access in 9.0. SmartGroup
serverless support is configurable through Terraform; CoPilot UI scope for
serverless SmartGroup creation is limited in this release.
* Serverless resources without VPC or VNet attachment are not discoverable by
the Cloud Asset Inventory.
* Azure Container Apps are enforced using the static IP of the managed
environment's internal load balancer, which may fall outside the subnet CIDR
if the IP space is exhausted.
* On AWS, if two or more Lambda functions share the same subnet and security
group, they may share the same network interface. The inventory associates
each interface with a single function.
* Policy enforcement requires an Aviatrix gateway in the same VPC/VNet or in a
peered network where traffic can be inspected.
## Related Topics
* DCF Overview
* DCF Policies and Rules