Overprivilege Analysis of Security Policies in Serverless Cloud Applications
2026-07-03 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors studied security problems in serverless cloud applications, where many parts work together and use lots of permissions. They found that nearly half of the applications give more access than needed, which can lead to attacks. They built a tool called PrivLess to check permissions versus what is actually used in code. Their results show that overprivilege is common and sometimes extreme, especially when using broad permission rules. This can allow attackers to do things like escalate their privileges or avoid detection.
serverless computingAWS Lambdaoverprivilegeaccess controlIAMstatic analysiscloud securityprivilege escalationdefense evasionpolicy misconfiguration
Authors
Elvis Yeboah-Duako, Pubali Datta
Abstract
Serverless computing has seen rapid adoption in cloud deployments, yet the security implications of its service-oriented programming model remain poorly understood. Distributed, modular, and heterogeneous applications complicate the specification of precise security policies. Role-based access control solutions such as Identity and Access Management (IAM) already exhibit pervasive misconfiguration problems, and the multiplicity of functions, services, and resources in serverless applications, together with frequent permission model changes by cloud providers, greatly increases the likelihood of policy misconfigurations. Consequently, policies are often overprivileged, thereby enlarging the attack surface and exposing sensitive cloud resources to compromise. We present a large-scale measurement study of overprivilege in real-world serverless applications, analyzing a curated dataset of 689 AWS Lambda applications comprised of 1,293 functions. To enable this study, we develop PrivLess, a static policy analysis framework that extracts function-to-resource interactions from application source code, derives an interaction-permission mapping, and reconciles inferred interactions with declared policies to quantify overprivilege. Our measurement reveals that overprivilege is systemic and severe across the serverless ecosystem: 47.7% of applications carry excess permissions with a significant privilege reduction potential of 99.65%. Applications with wildcard-defined permissions exhibited an average overprivilege ratio 274x higher than those without. More critically, the excess permissions enable concrete attack vectors: 18.8% of applications hold unnecessary Privilege Escalation capabilities, and 12 applications had Defense Evasion permissions they did not need.