AWS Lambda Functions in CSPM vs Workload Protection (Functions View)
Overview
After integrating AWS accounts through CSPM auto-discovery, Lambda functions appear under CSPM inventory and posture views. The same functions may not appear under Workload Protection → Functions until serverless workload integration is configured.
This article explains how the two modules differ and how to register functions for vulnerability scanning and runtime-oriented workload protection.
Understanding the Two Modules
| Module | Purpose | Lambda visibility |
|---|---|---|
| CSPM | Cloud security posture and configuration assessment | Functions discovered as cloud resources when the account is onboarded with appropriate permissions |
| Workload Protection | Runtime security and vulnerability assessment for workloads | Functions appear after Serverless Application integration for the account; new functions register during scheduled serverless scans |
CSPM discovery answers whether cloud functions exist and how they are configured. Workload Protection answers whether Aqua is scanning and managing those functions as serverless workloads.
Expected Behavior
- CSPM: All supported resources (including Lambda) that auto-discovery can reach are listed in CSPM views.
- Workload Protection → Functions: Empty or incomplete until a Serverless Application is added for the relevant cloud account.
- After Serverless Application integration completes, newly discovered functions register automatically on the serverless scan schedule.
Auto-discovery for CSPM does not replace Serverless Application setup for the Functions view in Workload Protection.
Configure Serverless Application Integration
- In the Aqua Console, open the serverless integration workflow for your cloud provider (AWS).
- Add a Serverless Application linked to the same cloud account used for CSPM auto-discovery.
- Confirm discovery options include functions where required during account onboarding.
- Allow the next scheduled serverless scan to run so functions register under Workload Protection.
Detailed steps: Add a serverless application to Aqua
Verification
- Open Workload Protection → Functions and confirm Lambda functions appear after integration and scan.
- Compare function count or sample names with CSPM inventory for the same account and region.
- Trigger or wait for a serverless scan and confirm registration timestamps update for new functions.
Important Considerations
- Integrating CSPM alone does not populate Workload Protection Functions.
- Each cloud account that should expose functions in Workload Protection needs the appropriate Serverless Application configuration.
- Permissions for CSPM and for serverless scanning must both satisfy Aqua documentation for your deployment.
Platform Coverage
- Components: CSPM, Workload Protection (serverless/functions)
- Platform: Aqua SaaS
- Cloud: AWS Lambda (pattern applies to serverless integrations generally)
Summary
| Question | Answer |
|---|---|
| Why are Lambdas in CSPM but not Functions? | CSPM and Workload Protection use different integration paths |
| What is required for Functions view? | Serverless Application for the cloud account |
| When do functions register? | After integration, via scheduled serverless scan |
Related Resources
Did you find it helpful? Yes No
Send feedback