-
Notifications
You must be signed in to change notification settings - Fork 461
feat(appsec): enable Exploit Prevention in Lambda #14827
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
feat(appsec): enable Exploit Prevention in Lambda #14827
Conversation
|
Bootstrap import analysisComparison of import times between this PR and base. SummaryThe average import time from this PR is: 241 ± 4 ms. The average import time from base is: 246 ± 6 ms. The import time difference between this PR and base is: -4.4 ± 0.2 ms. Import time breakdownThe following import paths have shrunk:
|
Performance SLOsComparing candidate florentin.labelle/APPSEC-59590/enable-rasp-for-lambda (485aefb) with baseline main (473fd58) 📈 Performance Regressions (2 suites)📈 iast_aspects - 40/40✅ re_expand_aspectTime: ✅ 31.967µs (SLO: <40.000µs 📉 -20.1%) vs baseline: -0.4% Memory: ✅ 37.729MB (SLO: <39.000MB -3.3%) vs baseline: +4.9% ✅ re_expand_noaspectTime: ✅ 28.768µs (SLO: <40.000µs 📉 -28.1%) vs baseline: +0.3% Memory: ✅ 37.709MB (SLO: <39.000MB -3.3%) vs baseline: +5.0% ✅ re_findall_aspectTime: ✅ 2.907µs (SLO: <10.000µs 📉 -70.9%) vs baseline: +0.5% Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.9% ✅ re_findall_noaspectTime: ✅ 1.439µs (SLO: <10.000µs 📉 -85.6%) vs baseline: +2.0% Memory: ✅ 37.611MB (SLO: <39.000MB -3.6%) vs baseline: +4.7% ✅ re_finditer_aspectTime: ✅ 4.497µs (SLO: <10.000µs 📉 -55.0%) vs baseline: -0.2% Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.7% ✅ re_finditer_noaspectTime: ✅ 1.413µs (SLO: <10.000µs 📉 -85.9%) vs baseline: +0.8% Memory: ✅ 37.709MB (SLO: <39.000MB -3.3%) vs baseline: +5.1% ✅ re_fullmatch_aspectTime: ✅ 2.694µs (SLO: <10.000µs 📉 -73.1%) vs baseline: +1.3% Memory: ✅ 37.631MB (SLO: <39.000MB -3.5%) vs baseline: +4.7% ✅ re_fullmatch_noaspectTime: ✅ 1.299µs (SLO: <10.000µs 📉 -87.0%) vs baseline: +0.6% Memory: ✅ 37.709MB (SLO: <39.000MB -3.3%) vs baseline: +4.9% ✅ re_group_aspectTime: ✅ 3.129µs (SLO: <10.000µs 📉 -68.7%) vs baseline: +6.2% Memory: ✅ 37.709MB (SLO: <39.000MB -3.3%) vs baseline: +5.0% ✅ re_group_noaspectTime: ✅ 1.595µs (SLO: <10.000µs 📉 -84.1%) vs baseline: -0.3% Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.9% ✅ re_groups_aspectTime: ✅ 3.295µs (SLO: <10.000µs 📉 -67.1%) vs baseline: +7.6% Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.9% ✅ re_groups_noaspectTime: ✅ 1.708µs (SLO: <10.000µs 📉 -82.9%) vs baseline: +0.2% Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.9% ✅ re_match_aspectTime: ✅ 3.117µs (SLO: <10.000µs 📉 -68.8%) vs baseline: 📈 +15.5% Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.8% ✅ re_match_noaspectTime: ✅ 1.316µs (SLO: <10.000µs 📉 -86.8%) vs baseline: +1.9% Memory: ✅ 37.709MB (SLO: <39.000MB -3.3%) vs baseline: +4.9% ✅ re_search_aspectTime: ✅ 2.707µs (SLO: <10.000µs 📉 -72.9%) vs baseline: +5.6% Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.9% ✅ re_search_noaspectTime: ✅ 1.207µs (SLO: <10.000µs 📉 -87.9%) vs baseline: +0.8% Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +5.1% ✅ re_sub_aspectTime: ✅ 3.631µs (SLO: <10.000µs 📉 -63.7%) vs baseline: +6.2% Memory: ✅ 37.631MB (SLO: <39.000MB -3.5%) vs baseline: +4.6% ✅ re_sub_noaspectTime: ✅ 1.561µs (SLO: <10.000µs 📉 -84.4%) vs baseline: +2.6% Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +5.0% ✅ re_subn_aspectTime: ✅ 3.802µs (SLO: <10.000µs 📉 -62.0%) vs baseline: +4.1% Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.6% ✅ re_subn_noaspectTime: ✅ 1.613µs (SLO: <10.000µs 📉 -83.9%) vs baseline: +1.2% Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.8% 📈 iastaspectsospath - 24/24✅ ospathbasename_aspectTime: ✅ 5.046µs (SLO: <10.000µs 📉 -49.5%) vs baseline: 📈 +16.8% Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.9% ✅ ospathbasename_noaspectTime: ✅ 1.089µs (SLO: <10.000µs 📉 -89.1%) vs baseline: ~same Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +5.0% ✅ ospathjoin_aspectTime: ✅ 6.098µs (SLO: <10.000µs 📉 -39.0%) vs baseline: ~same Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.8% ✅ ospathjoin_noaspectTime: ✅ 2.324µs (SLO: <10.000µs 📉 -76.8%) vs baseline: +1.3% Memory: ✅ 37.611MB (SLO: <39.000MB -3.6%) vs baseline: +4.5% ✅ ospathnormcase_aspectTime: ✅ 3.847µs (SLO: <10.000µs 📉 -61.5%) vs baseline: 📈 +10.9% Memory: ✅ 37.631MB (SLO: <39.000MB -3.5%) vs baseline: +4.6% ✅ ospathnormcase_noaspectTime: ✅ 0.574µs (SLO: <10.000µs 📉 -94.3%) vs baseline: +0.6% Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +5.1% ✅ ospathsplit_aspectTime: ✅ 4.904µs (SLO: <10.000µs 📉 -51.0%) vs baseline: -0.4% Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.9% ✅ ospathsplit_noaspectTime: ✅ 1.596µs (SLO: <10.000µs 📉 -84.0%) vs baseline: -0.8% Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.9% ✅ ospathsplitdrive_aspectTime: ✅ 3.648µs (SLO: <10.000µs 📉 -63.5%) vs baseline: +0.1% Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.9% ✅ ospathsplitdrive_noaspectTime: ✅ 0.702µs (SLO: <10.000µs 📉 -93.0%) vs baseline: -1.6% Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.9% ✅ ospathsplitext_aspectTime: ✅ 4.742µs (SLO: <10.000µs 📉 -52.6%) vs baseline: +3.4% Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.9% ✅ ospathsplitext_noaspectTime: ✅ 1.389µs (SLO: <10.000µs 📉 -86.1%) vs baseline: ~same Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.7% 🟡 Near SLO Breach (6 suites)🟡 djangosimple - 30/30✅ appsecTime: ✅ 20.450ms (SLO: <22.300ms -8.3%) vs baseline: -0.2% Memory: ✅ 65.502MB (SLO: <67.000MB -2.2%) vs baseline: +4.9% ✅ exception-replay-enabledTime: ✅ 1.350ms (SLO: <1.450ms -6.9%) vs baseline: +0.7% Memory: ✅ 64.600MB (SLO: <67.000MB -3.6%) vs baseline: +4.7% ✅ iastTime: ✅ 20.438ms (SLO: <22.250ms -8.1%) vs baseline: -0.3% Memory: ✅ 65.463MB (SLO: <67.000MB -2.3%) vs baseline: +4.8% ✅ profilerTime: ✅ 15.340ms (SLO: <16.550ms -7.3%) vs baseline: +0.6% Memory: ✅ 53.808MB (SLO: <54.500MB 🟡 -1.3%) vs baseline: +5.1% ✅ resource-renamingTime: ✅ 20.548ms (SLO: <21.750ms -5.5%) vs baseline: ~same Memory: ✅ 65.500MB (SLO: <67.000MB -2.2%) vs baseline: +4.9% ✅ span-code-originTime: ✅ 26.132ms (SLO: <28.200ms -7.3%) vs baseline: -0.2% Memory: ✅ 67.681MB (SLO: <69.500MB -2.6%) vs baseline: +3.2% ✅ tracerTime: ✅ 20.449ms (SLO: <21.750ms -6.0%) vs baseline: -0.5% Memory: ✅ 65.390MB (SLO: <67.000MB -2.4%) vs baseline: +4.7% ✅ tracer-and-profilerTime: ✅ 22.088ms (SLO: <23.500ms -6.0%) vs baseline: ~same Memory: ✅ 66.586MB (SLO: <67.500MB 🟡 -1.4%) vs baseline: +4.9% ✅ tracer-dont-create-db-spansTime: ✅ 19.329ms (SLO: <21.500ms 📉 -10.1%) vs baseline: -0.2% Memory: ✅ 65.494MB (SLO: <66.000MB 🟡 -0.8%) vs baseline: +4.9% ✅ tracer-minimalTime: ✅ 16.616ms (SLO: <17.500ms -5.1%) vs baseline: ~same Memory: ✅ 65.428MB (SLO: <66.000MB 🟡 -0.9%) vs baseline: +4.9% ✅ tracer-nativeTime: ✅ 20.452ms (SLO: <21.750ms -6.0%) vs baseline: -0.2% Memory: ✅ 71.491MB (SLO: <72.500MB 🟡 -1.4%) vs baseline: +4.9% ✅ tracer-no-cachesTime: ✅ 18.465ms (SLO: <19.650ms -6.0%) vs baseline: -0.1% Memory: ✅ 65.413MB (SLO: <67.000MB -2.4%) vs baseline: +4.7% ✅ tracer-no-databasesTime: ✅ 18.740ms (SLO: <20.100ms -6.8%) vs baseline: -0.4% Memory: ✅ 65.271MB (SLO: <67.000MB -2.6%) vs baseline: +4.6% ✅ tracer-no-middlewareTime: ✅ 20.161ms (SLO: <21.500ms -6.2%) vs baseline: -0.2% Memory: ✅ 65.437MB (SLO: <67.000MB -2.3%) vs baseline: +4.7% ✅ tracer-no-templatesTime: ✅ 20.267ms (SLO: <22.000ms -7.9%) vs baseline: -0.2% Memory: ✅ 65.464MB (SLO: <67.000MB -2.3%) vs baseline: +4.9% 🟡 errortrackingdjangosimple - 6/6✅ errortracking-enabled-allTime: ✅ 18.033ms (SLO: <19.850ms -9.2%) vs baseline: -0.2% Memory: ✅ 65.235MB (SLO: <66.500MB 🟡 -1.9%) vs baseline: +4.8% ✅ errortracking-enabled-userTime: ✅ 18.059ms (SLO: <19.400ms -6.9%) vs baseline: +0.3% Memory: ✅ 65.274MB (SLO: <66.500MB 🟡 -1.8%) vs baseline: +4.9% ✅ tracer-enabledTime: ✅ 18.217ms (SLO: <19.450ms -6.3%) vs baseline: +0.6% Memory: ✅ 65.195MB (SLO: <66.500MB 🟡 -2.0%) vs baseline: +4.7% 🟡 flasksimple - 18/18✅ appsec-getTime: ✅ 4.581ms (SLO: <4.750ms -3.6%) vs baseline: -0.2% Memory: ✅ 61.951MB (SLO: <65.000MB -4.7%) vs baseline: +5.0% ✅ appsec-postTime: ✅ 6.584ms (SLO: <6.750ms -2.5%) vs baseline: -0.2% Memory: ✅ 62.030MB (SLO: <65.000MB -4.6%) vs baseline: +4.9% ✅ appsec-telemetryTime: ✅ 4.572ms (SLO: <4.750ms -3.8%) vs baseline: ~same Memory: ✅ 61.833MB (SLO: <65.000MB -4.9%) vs baseline: +4.6% ✅ debuggerTime: ✅ 1.860ms (SLO: <2.000ms -7.0%) vs baseline: -0.2% Memory: ✅ 45.495MB (SLO: <47.000MB -3.2%) vs baseline: +5.0% ✅ iast-getTime: ✅ 1.883ms (SLO: <2.000ms -5.8%) vs baseline: +1.3% Memory: ✅ 42.428MB (SLO: <49.000MB 📉 -13.4%) vs baseline: +4.9% ✅ profilerTime: ✅ 1.908ms (SLO: <2.100ms -9.1%) vs baseline: -0.2% Memory: ✅ 46.478MB (SLO: <47.000MB 🟡 -1.1%) vs baseline: +4.6% ✅ resource-renamingTime: ✅ 3.383ms (SLO: <3.650ms -7.3%) vs baseline: +0.2% Memory: ✅ 52.219MB (SLO: <53.500MB -2.4%) vs baseline: +4.7% ✅ tracerTime: ✅ 3.368ms (SLO: <3.650ms -7.7%) vs baseline: ~same Memory: ✅ 52.298MB (SLO: <53.500MB -2.2%) vs baseline: +5.0% ✅ tracer-nativeTime: ✅ 3.372ms (SLO: <3.650ms -7.6%) vs baseline: -0.2% Memory: ✅ 58.333MB (SLO: <60.000MB -2.8%) vs baseline: +5.0% 🟡 flasksqli - 6/6✅ appsec-enabledTime: ✅ 3.936ms (SLO: <4.200ms -6.3%) vs baseline: +0.1% Memory: ✅ 62.246MB (SLO: <66.000MB -5.7%) vs baseline: +5.0% ✅ iast-enabledTime: ✅ 2.451ms (SLO: <2.800ms 📉 -12.5%) vs baseline: -0.1% Memory: ✅ 58.864MB (SLO: <60.000MB 🟡 -1.9%) vs baseline: +4.7% ✅ tracer-enabledTime: ✅ 2.073ms (SLO: <2.250ms -7.9%) vs baseline: -0.1% Memory: ✅ 52.239MB (SLO: <54.500MB -4.1%) vs baseline: +5.0% 🟡 otelspan - 22/22✅ add-eventTime: ✅ 42.355ms (SLO: <47.150ms 📉 -10.2%) vs baseline: -0.2% Memory: ✅ 44.422MB (SLO: <47.000MB -5.5%) vs baseline: +4.8% ✅ add-metricsTime: ✅ 318.903ms (SLO: <344.800ms -7.5%) vs baseline: ~same Memory: ✅ 594.768MB (SLO: <600.000MB 🟡 -0.9%) vs baseline: +4.6% ✅ add-tagsTime: ✅ 286.057ms (SLO: <314.000ms -8.9%) vs baseline: -1.0% Memory: ✅ 596.212MB (SLO: <600.000MB 🟡 -0.6%) vs baseline: +4.7% ✅ get-contextTime: ✅ 80.951ms (SLO: <92.350ms 📉 -12.3%) vs baseline: +0.8% Memory: ✅ 39.981MB (SLO: <46.500MB 📉 -14.0%) vs baseline: +4.9% ✅ is-recordingTime: ✅ 39.596ms (SLO: <44.500ms 📉 -11.0%) vs baseline: +2.1% Memory: ✅ 43.916MB (SLO: <47.500MB -7.5%) vs baseline: +4.8% ✅ record-exceptionTime: ✅ 59.122ms (SLO: <67.650ms 📉 -12.6%) vs baseline: +0.3% Memory: ✅ 40.225MB (SLO: <47.000MB 📉 -14.4%) vs baseline: +4.7% ✅ set-statusTime: ✅ 45.486ms (SLO: <50.400ms -9.8%) vs baseline: +1.4% Memory: ✅ 43.936MB (SLO: <47.000MB -6.5%) vs baseline: +4.8% ✅ startTime: ✅ 38.221ms (SLO: <43.450ms 📉 -12.0%) vs baseline: +0.2% Memory: ✅ 43.967MB (SLO: <47.000MB -6.5%) vs baseline: +4.9% ✅ start-finishTime: ✅ 84.340ms (SLO: <88.000ms -4.2%) vs baseline: +2.2% Memory: ✅ 34.583MB (SLO: <46.500MB 📉 -25.6%) vs baseline: +5.0% ✅ start-finish-telemetryTime: ✅ 85.486ms (SLO: <89.000ms -3.9%) vs baseline: +2.1% Memory: ✅ 34.505MB (SLO: <46.500MB 📉 -25.8%) vs baseline: +5.0% ✅ update-nameTime: ✅ 40.338ms (SLO: <45.150ms 📉 -10.7%) vs baseline: +0.8% Memory: ✅ 44.198MB (SLO: <47.000MB -6.0%) vs baseline: +4.8% 🟡 span - 26/26✅ add-eventTime: ✅ 21.180ms (SLO: <22.500ms -5.9%) vs baseline: +2.9% Memory: ✅ 50.348MB (SLO: <53.000MB -5.0%) vs baseline: +5.0% ✅ add-metricsTime: ✅ 91.322ms (SLO: <93.500ms -2.3%) vs baseline: +0.6% Memory: ✅ 660.799MB (SLO: <961.000MB 📉 -31.2%) vs baseline: +4.8% ✅ add-tagsTime: ✅ 148.045ms (SLO: <155.000ms -4.5%) vs baseline: -0.2% Memory: ✅ 661.671MB (SLO: <962.500MB 📉 -31.3%) vs baseline: +4.9% ✅ get-contextTime: ✅ 19.509ms (SLO: <20.500ms -4.8%) vs baseline: +1.4% Memory: ✅ 49.168MB (SLO: <53.000MB -7.2%) vs baseline: +5.0% ✅ is-recordingTime: ✅ 19.598ms (SLO: <20.500ms -4.4%) vs baseline: +0.1% Memory: ✅ 49.096MB (SLO: <53.000MB -7.4%) vs baseline: +4.7% ✅ record-exceptionTime: ✅ 38.469ms (SLO: <40.000ms -3.8%) vs baseline: +0.4% Memory: ✅ 42.734MB (SLO: <53.000MB 📉 -19.4%) vs baseline: +4.8% ✅ set-statusTime: ✅ 21.329ms (SLO: <22.000ms -3.0%) vs baseline: +0.6% Memory: ✅ 49.133MB (SLO: <53.000MB -7.3%) vs baseline: +4.8% ✅ startTime: ✅ 19.419ms (SLO: <20.500ms -5.3%) vs baseline: +0.9% Memory: ✅ 49.138MB (SLO: <53.000MB -7.3%) vs baseline: +4.8% ✅ start-finishTime: ✅ 51.650ms (SLO: <52.500ms 🟡 -1.6%) vs baseline: +0.2% Memory: ✅ 32.086MB (SLO: <34.000MB -5.6%) vs baseline: +4.7% ✅ start-finish-telemetryTime: ✅ 53.093ms (SLO: <54.500ms -2.6%) vs baseline: +0.8% Memory: ✅ 32.165MB (SLO: <34.000MB -5.4%) vs baseline: +4.8% ✅ start-finish-traceid128Time: ✅ 55.944ms (SLO: <56.000ms 🟡 -0.1%) vs baseline: +2.1% Memory: ✅ 32.106MB (SLO: <34.000MB -5.6%) vs baseline: +4.7% ✅ start-traceid128Time: ✅ 19.779ms (SLO: <22.500ms 📉 -12.1%) vs baseline: +0.6% Memory: ✅ 49.155MB (SLO: <53.000MB -7.3%) vs baseline: +4.8% ✅ update-nameTime: ✅ 20.332ms (SLO: <22.000ms -7.6%) vs baseline: +1.0% Memory: ✅ 49.837MB (SLO: <53.000MB -6.0%) vs baseline: +5.0%
|
7c88886
to
edc1a9b
Compare
edc1a9b
to
485aefb
Compare
Description
Stop explicitely disabling Exploit Prevention in AWS Lambda
Testing
system-tests for lambda are passing [TODO: refer PR] and will be enabled after this PR is merged.
Risks
None
Additional Notes