# SAM template -- goede IAM policy
Resources:
  ProcessOrderFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: index.handler
      Runtime: python3.11
      Policies:
        # Specifieke permissions, niet AmazonS3FullAccess
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - s3:GetObject
              Resource: !Sub "arn:aws:s3:::${OrderBucket}/orders/*"
            - Effect: Allow
              Action:
                - dynamodb:PutItem
              Resource: !GetAtt OrderTable.Arn
              Condition:
                ForAllValues:StringEquals:
                  dynamodb:LeadingKeys:
                    - "${aws:PrincipalTag/orderId}"

# Lambda in een VPC -- beperkt outbound traffic
Resources:
  SecureFunction:
    Type: AWS::Serverless::Function
    Properties:
      VpcConfig:
        SecurityGroupIds:
          - !Ref FunctionSecurityGroup
        SubnetIds:
          - !Ref PrivateSubnet1
          - !Ref PrivateSubnet2

  FunctionSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Lambda function security group
      VpcId: !Ref VPC
      SecurityGroupEgress:
        # Alleen toegang tot specifieke services
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          DestinationPrefixListId: !Ref S3PrefixList  # Alleen S3

# CI/CD pipeline stap: scan dependencies
# Python
pip install pip-audit safety
pip-audit -r requirements.txt --strict
safety check -r requirements.txt

# Node.js
npm audit --audit-level=high
npx snyk test

# Scan Lambda layers
aws lambda get-layer-version \
  --layer-name shared-layer --version-number 1 \
  --query 'Content.Location' --output text \
  | xargs curl -o layer.zip
unzip layer.zip -d layer-scan/
pip-audit -r layer-scan/python/requirements.txt

# Lambda wrapper voor runtime protection
import os
import socket

# Blokkeer outbound DNS naar niet-standaard servers
_original_getaddrinfo = socket.getaddrinfo

def _restricted_getaddrinfo(host, port, *args, **kwargs):
    # Sta alleen bekende hosts toe
    allowed = ['dynamodb.eu-west-1.amazonaws.com', 's3.eu-west-1.amazonaws.com']
    if host not in allowed and not host.endswith('.amazonaws.com'):
        raise socket.gaierror(f"DNS lookup blocked for: {host}")
    return _original_getaddrinfo(host, port, *args, **kwargs)

if os.environ.get('RESTRICT_NETWORK') == 'true':
    socket.getaddrinfo = _restricted_getaddrinfo