Class LambdaSecurityRules

java.lang.Object

com.cloudforgeci.api.core.rules.LambdaSecurityRules

All Implemented Interfaces:

FrameworkRules<SystemContext>

@ComplianceFramework(value="LambdaSecurity",
                     priority=0,
                     alwaysLoad=true,
                     displayName="Lambda Security",
                     description="Cross-framework Lambda function security validation")
public class LambdaSecurityRules
extends Object
implements FrameworkRules<SystemContext>

Lambda security compliance validation rules.

These rules enforce Lambda function security requirements across multiple compliance frameworks:

• PCI-DSS - Req 6: Secure development; Req 10: Logging
• HIPAA - §164.312(d): Audit controls
• SOC 2 - CC7.1: Security monitoring
• GDPR - Art.32: Security of processing

Controls Implemented

• Lambda VPC deployment
• Environment variable encryption
• Dead letter queue configuration
• X-Ray tracing
• Code signing

Since:

3.0.0

Constructor Summary

Constructors

Constructor	Description
LambdaSecurityRules()

Method Summary

Modifier and Type	Method	Description
Set<String>	claimedControls()	Controls checked across every validate* method above -- see FrameworkRules.claimedControls().
void	install(SystemContext ctx)	Install Lambda security validation rules.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface FrameworkRules

alwaysLoad, description, displayName, frameworkId, getRequiredConfiguration, priority

Constructor Details

LambdaSecurityRules

public LambdaSecurityRules()

Method Details

install

public void install(SystemContext ctx)

Install Lambda security validation rules. An always-load, cross-framework class -- runs for every deployment regardless of which compliance frameworks are selected.

Specified by:

install in interface FrameworkRules<SystemContext>

Parameters:

ctx - System context

claimedControls

public Set<String> claimedControls()

Controls checked across every validate* method above -- see FrameworkRules.claimedControls(). Dead letter queue configuration is a conditional check with no corresponding matrix control and is not claimed.

LAMBDA_SECURITY is claimed on the strength of LAMBDA-PUBLIC-ACCESS alone, which runs unconditionally and is verified against the code (no Function URL, public resource-policy grant, or public addPermission exists anywhere in this codebase) -- see its comment in install(). The app-level checks below it (VPC placement, encryption, monitoring, DLQ) are gated on a self-attested lambdaEnabled flag with no Lambda construct behind it, since no LambdaFactory exists yet; those remain decorative until app-level Lambda support is added -- not claimed on that basis, only on LAMBDA-PUBLIC-ACCESS's structural guarantee.

Specified by:

claimedControls in interface FrameworkRules<SystemContext>

Returns:

the control identifiers this framework's install() validates; empty if undeclared