SLS-9: Insufficient Logging & Monitoring

Before you start: make sure you are in the project directory.

cd /workspaces/very-vulnerable-serverless

Theory: What is Insufficient Logging & Monitoring?

Logging records what happens (requests, errors, logins). Monitoring watches those logs and raises an alert when something looks wrong. Without them, an attack happens and nobody knows.

Example: Someone tries 10,000 passwords on your login. With monitoring, an alarm fires after 20 failures. Without it, they get in and you find out weeks later.

Objective

Check whether serverless.yml has any alarms, tracing, WAF, or logging, to see if the earlier attacks could have been detected.

Check if the deployment config mentions any monitoring:

grep -ic 'alarm\|trace\|waf\|xray\|logging' serverless.yml

Output:

0

Zero matches. No CloudWatch alarms, no X-Ray tracing, no WAF, no application-level security logging. We exploited six different vulnerabilities in this workshop. None of them triggered an alert.

Impact: Attacks succeed silently. No one is paged. You would not know until the damage is discovered — days or weeks later.

Fix: Enable X-Ray tracing (tracing: lambda: true in serverless.yml). Add CloudWatch alarms for error rates and unusual invocation counts. Deploy AWS WAF on API Gateway to block known attack patterns.