> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/admin-guide/install/deploy-defender/serverless/install-serverless-defender-layer.md).

# Deploy Serverless Defender as a Lambda Layer

Prisma Cloud Serverless Defenders protect serverless functions at runtime. Currently, Prisma Cloud supports AWS Lambda functions.

Lambda layers are ZIP archives that contain libraries, custom runtimes, or other dependencies. Layers let you add reusable components to your functions, and focus deployment packages on business logic. They are extracted to the */opt* directory in the function execution environment. For more information, see the [AWS Lambda layers documentation](https://docs.aws.amazon.com/lambda/latest/dg/configuration-layers.html).

Prisma Cloud delivers Serverless Defender as a Lambda layer. Deploy Serverless Defender to your function by wrapping the handler and setting an environment variable.

## Secure the Serverless Functions

To secure an AWS Lambda function with the Serverless Defender layer:

1. Download the Serverless Defender Lambda layer ZIP file.
2. Upload the layer to AWS.
3. Define a serverless protection runtime policy.
4. Define a serverless WAAS policy.
5. Add the layer to your function, update the handler, and set an environment variable. After completing this integration, Serverless Defender runs when your function is invoked.

## Download the Serverless Defender Layer

Download the Serverless Defender layer from Compute Console.

1. Open Console, then go to **Manage > Defenders > Deploy> Defenders > Single Defender**.
2. Choose the DNS name or IP address that Serverless Defender uses to connect to Console.
3. Set the Defender type to **Serverless Defender**.
4. Select a runtime.

   Prisma Cloud supports Lambda layers for **Node.js**, **Python**, **Ruby**, **C#**, and **Java**. See [system requirements](/admin-guide/install/system-requirements.md#serverless-runtimes) for the runtimes that are supported for Serverless Defender as a Lambda layer.
5. For **Deployment Type**, select **Layer**.
6. Download the Serverless Defender layer. A ZIP file is downloaded to your host.

## Upload the Serverless Defender layer to AWS

Add the layer to the AWS Lambda service as a resource available to all functions.

1. In the AWS Management Console, go to the Lambda service.
2. Select **Layers > Create Layer**.

   <figure><img src="/files/MBKVgXSUvS6rYxQwLnqu" alt="serverless layer layers"><figcaption></figcaption></figure>
3. In **Name**, enter **twistlock**.
4. Click **Upload**, and select the file you just downloaded, *twistlock\_defender\_layer.zip*
   1. Select the compatible runtimes: **Python**, **Node.js**, **\*Ruby**, **C#**, or **Java**.
   2. Click **Create**.

      <figure><img src="/files/k5CdDcN8Rx0NYeKKR2md" alt="serverless layer create"><figcaption></figcaption></figure>

## Define your Runtime Protection Policy

By default, Prisma Cloud ships with an empty serverless runtime policy. An empty policy disables runtime defense entirely.

You can enable runtime defense by creating a rule. By default, new rules:

* Apply to all functions (`*`), but you can target them to specific functions by function name.
* Block all processes from running except the main process. This protects against command injection attacks.

When functions are invoked, they connect to Compute Console and retrieve the latest policy. To ensure that functions start executing at time=0 with your custom policy, you must predefine the policy. Predefined policy is embedded into your function along with the Serverless Defender by way of the `TW_POLICY` environment variable.

1. Log into Prisma Cloud Console.
2. Go to **Defend > Runtime > Serverless Policy**.
3. Click **Add rule**.
4. In the **General** tab, enter a rule name.
5. (Optional) Target the rule to specific functions.
6. Set the rule parameters in the **Processes**, **Networking**, and **File System** tabs.
7. Click **Save**.

## Define your Serverless WAAS Policy

Prisma Cloud lets you protect your serverless functions against application layer attacks by utilizing the serverless [Web Application and API Security (WAAS)](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/compute-edition/34/admin-guide/waas/waas.md).

By default, the serverless WAAS is disabled. To enable it, add a new serverless WAAS rule.

1. Log into Prisma Cloud Console.
2. Go to **Defend > WAAS > Serverless**.
3. Click **Add rule**.
4. In the **General** tab, enter a rule name.
5. (Optional) Target the rule to specific functions.
6. Set the protections you want to apply (**SQLi**, **CMDi**, **Code injection**, **XSS**, **LFI**).
7. Click **Save**.

## Embed the Serverless Defender

Embed the Serverless Defender as a layer, and run it when your function is invoked. If you are using a deployment framework such as [SAM](https://aws.amazon.com/blogs/compute/working-with-aws-lambda-and-lambda-layers-in-aws-sam/) or [Serverless Framework](https://serverless.com/framework/docs/providers/aws/guide/layers#using-your-layers) you can reference the layer from within the configuration file.

**Prerequisites:**

* You already have a Lambda function.
* Your Lambda function is written for Node.js, Python, or Ruby.
* Your function’s execution role grants it permission to write to CloudWatch Logs. Note that the **AWSLambdaBasicExecutionRole** grants permission to write to CloudWatch Logs.

1. Go to the function designer in the AWS Management Console.
2. Click on the **Layers** icon.

   <figure><img src="/files/odU4VV0JfjW8Zm6f61ho" alt="serverless layer function designer layers"><figcaption></figcaption></figure>
3. In the **Referenced Layers** panel, click **Add a layer**.

   <figure><img src="/files/jlOtK8AbiX5F92bdNkzN" alt="serverless layer add a layer"><figcaption></figcaption></figure>

   1. In the **Select from list of runtime compatible layers**, select **twistlock**.
   2. In the **Version** drop-down list, select **1**.
   3. Click **Add**.

      <figure><img src="/files/pZCXwFGSVx238lqmCze1" alt="serverless layer add a layer2"><figcaption></figcaption></figure>

      When you return to the function designer, you’ll see that your function now uses one layer.

      <figure><img src="/files/j4POP1Fa2Co426ZPGnk3" alt="serverless layer function designer layers2"><figcaption></figcaption></figure>
4. Update the handler for your function to be *twistlock.handler*.

   <figure><img src="/files/IXughZaSvXOlznvAftga" alt="lambda handler"><figcaption></figcaption></figure>
5. Set the *TW\_POLICY* and *ORIGINAL\_HANDLER* environment variable, which specifies how your function connects to Compute Console to retrieve policy and send audits.
   1. In Compute Console, go to **Manage > Defenders > Deploy > Single Defender**.
   2. For **Defender type**, select **Serverless**.
   3. In **Set the Twistlock environment variable**, enter the function name and region.
   4. Copy the generated **Value**.
   5. In AWS Console, open your function in the designer, and scroll down to the **Environment variables** panel.
   6. For **Key**, enter TW\_POLICY.
   7. For **Value**, paste the rule you copied from Compute Console.
   8. For *ORIGINAL\_HANDLER*, this is the original value of handler for your function before your modification.
6. Click **Save** to preserve all your changes.

   <figure><img src="/files/nGmbHI19inqoCmZfipIJ" alt="lambda env variables"><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/admin-guide/install/deploy-defender/serverless/install-serverless-defender-layer.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.