AppDefender for DigitalOcean Functions
Prerequisites
- a license key. Get one if you don't have one already.
- information about your DigitalOcean function:
- DigitalOcean Functions runtime, e.g.
Nodejs 18
- AppDefender is supported on DigitalOcean Functions Node.js and Python runtimes. Reference our support Matrix for more details.
- DigitalOcean Functions runtime, e.g.
- permission to deploy a new version of your function with AppDefender enabled
Configure AppDefender
Install and import library
Import AppDefender as a dependency in your function based on your language, so DigitalOcean Functions runtime can download and install it during function deployment. Make sure to replace the version numbers below with the latest. For local development, install the AppDefender packages from the public repositories for your runtime directly, e.g. npm install @extrinsec/appdefender
Node.js
- update your
package.json
file to include the AppDefender npm packagepackage.json{
"main": "index.js",
"dependencies": {
...
"@extrinsec/appdefender": "latest"
}
} - import AppDefender in the main entry point for each function, e.g.index.js
const appdefender = require('@extrinsec/appdefender');
Python
- update your
requirements.txt
file to include the AppDefender Python packagerequirements.txtappdefender
- import AppDefender in the main entry point for each function, e.g.main.py
import appdefender
Set environment variables
add the following environment variables to your serverless function/application
ES_LICENSE_KEY=
your license keyES_POLICY_GROUP_NAME=
name of your policy group, useobserveAll.ability
if you have a temporary license key
Invoke function
- Invoke your function and seee AppDefender in action in your logs
Configure Policy Groups
- if you have a registered account, then you can create and edit your own policy groups
- if you have a temporary license key, then please use either the
observeAll.ability
public policy group or register for a free account and create your own custom policy group - each policy group contains instructions for AppDefender during execution:
- Grant, Observe, or Deny access to any combination of the following:
- outbound network traffic from the serverless function/application process
- read/write on the /tmp/ or application directories
- create/spawn child processes
- whether to terminate serverless serverless function/application execution for any deny event
- whether to allow all cloud provider traffic if outbound data is set to deny. Note: you must upgrade your free plan in order to enable this feature
- this is cloud provider specific, so if you are running on GCF and this option is set, all Google Cloud traffic would be allowed
- a custom list of allowed domains if outbound data is set to deny
- domain names are matched as contains by default, e.g.
stripe
(contains) would matchstripe.com
as well asm.stripe.com
- wildcards can also be used, e.g.
*.amazonaws.com
(end with) orlabmda.*
(starts with) - multiple domains are comma separated
- AppDefender performs DNS resolution to act on all IP addresses matching the specified domain names
- domain names are matched as contains by default, e.g.
- A optional description field for you to document the purpose or other details of the policy group
- Grant, Observe, or Deny access to any combination of the following:
- create as many policy groups as you have unique needs. There is no limit on how many policy groups you may have
- once a policy group is updated, the changes are automatically picked up by any AppDefender protected application during its next start/restart
View Your Functions and Events
- if you have a registered account, you can view all your functions/applications in the dashboard automatically, as reported by AppDefender. The cloud provider information, as well as the language runtime and policy group used, are all shown
- you can also view all events as detected by AppDefender in the dashboard
- each event is a observe or deny occurrence as outlined in the section above. Note: grant policies don't generate events
- events are reported by the AppDefender to your dashboard in real time. You can use event reporting to better understand the actions of your functions/applications, as well as inform you on how to better customize your policy groups
- events are kept for different durations depending on your current pricing plan