Growlithe: A Developer-Centric Compliance Tool for Serverless Applications

Growlithe: A Developer-Centric Compliance Tool for Serverless Applications

Speakers: Praveen Gupta, Arshia Moghimi, Devam Sisodraker, Mohammad Shahrad, Aastha Mehta

Conference: IEEE S&P

YouTube: https://www.youtube.com/watch?v=M5w21PGPMNa

Overview

The talk introduces Growlithe, an innovative compliance tool developed by researchers at the University of British Columbia, designed to empower serverless developers in meeting their data protection obligations. As serverless applications increasingly handle sensitive information like personally identifiable data, financial records, and user credentials, the unique characteristics of this paradigm—such as heterogeneity, unpredictable execution environments, and complex distributed architectures—present significant data protection challenges. Growlithe aims to address these by providing a structured, automated approach to define, enforce, and validate data access and information flow policies throughout the serverless development lifecycle.

Growlithe directly confronts the limitations of existing cloud provider tools, which are often too coarse-grained and difficult to configure for the nuanced requirements of serverless functions. By integrating policy enforcement directly into the application's build and deployment process, Growlithe helps mitigate risks associated with accidental data leaks, misconfigurations, and evolving application complexity. The system's hybrid enforcement mechanism, combining static analysis with runtime checks, ensures both efficiency and comprehensive coverage, making it a crucial advancement for developers navigating the shared responsibility model in cloud security.

The core contribution of Growlithe lies in its ability to generate a language and platform-independent data flow graph from application source code and cloud configurations. This graph then serves as the foundation for developers to specify granular access control and information flow policies using a declarative language. The tool automatically instruments the application to enforce these policies, ensuring that compliance is a built-in feature rather than an afterthought, thereby streamlining the development of secure and compliant serverless applications in a rapidly evolving cloud landscape.

Background

▶ Watch: Challenges of serverless data protection and compliance (0:00)

Serverless computing has witnessed an explosion in popularity due to its promise of reduced operational overhead, abstracting away infrastructure management from developers. Cloud providers handle the underlying servers, scaling, and maintenance, allowing developers to focus solely on writing business logic. This model has facilitated rapid development and deployment, making it attractive for applications processing highly sensitive data, from financial transactions to personal health information. However, the very characteristics that make serverless appealing also introduce a unique set of security and compliance hurdles.

Firstly, serverless applications are inherently heterogeneous. They often comprise functions written in multiple programming languages (e.g., Python, JavaScript, Go) interacting with diverse cloud services (e.g., S3, DynamoDB, SQS). This polyglot nature makes it exceedingly difficult to design and uniformly apply a coherent data protection strategy across the entire application stack. Traditional security tools often struggle with this diversity, leading to fragmented or incomplete coverage.

Secondly, serverless environments are unpredictable. Functions are short-running, ephemeral, and often share underlying physical infrastructure or containers. While cloud providers strive for isolation, the dynamic nature of container lifecycle management, including container reuse ("warm starts"), raises concerns about potential accidental data leaks across requests or between different tenants if not properly managed at the application layer. Ensuring data confidentiality and integrity in such a fluid environment is a significant challenge for developers.

Thirdly, serverless applications tend to become complex over time. As they evolve, they integrate with an increasing number of distributed components, including various storage solutions, event sources, and third-party APIs. This distributed and dynamic architecture elevates the risk of bugs and misconfigurations, particularly concerning data access and flow. Manually tracking and enforcing data protection policies across such intricate systems is error-prone and unsustainable.

The prevailing model for security and compliance in the cloud is the shared responsibility model. Cloud providers are responsible for the security of the cloud (the underlying infrastructure, hardware, network, etc.), while cloud tenants are responsible for security in the cloud. This includes configuring access control, ensuring data confidentiality, and maintaining data integrity within their applications. While cloud providers offer tools for Identity and Access Management (IAM), these tools are often tied to specific cloud platforms, are coarse-grained, and notoriously difficult to configure correctly. For instance, defining an IAM policy to allow a function access to an S3 bucket is straightforward, but restricting that access based on the content of the data, the region of the bucket, or the temporal context of the request is beyond their capabilities. These limitations mean that existing IAM solutions are insufficient to tackle the fine-grained, serverless-specific challenges of data protection and compliance. This gap highlights the critical need for developer-centric tools like Growlithe that can integrate compliance directly into the serverless application lifecycle.

Key Findings

▶ Watch: Growlithe's three-stage design overview (2:35)

Growlithe presents a novel, developer-centric approach to integrate data protection and compliance into serverless applications, delivering several key findings and contributions:

1. Three-Stage Design for Comprehensive Compliance: Growlithe's architecture is built upon a robust three-stage process:

• Data Flow Graph Construction: It automatically generates a language and platform-independent data flow graph that meticulously maps how data traverses between functions and various cloud services within an application. This foundational graph provides a holistic view of data movement, which is crucial for identifying potential policy violation points.
• Developer Policy Annotation: Developers can then annotate this graph with declarative policies, specifying precise access control and information flow requirements. This intuitive, graph-based policy definition simplifies a historically complex task.
• Hybrid Policy Enforcement: Growlithe employs a hybrid enforcement mechanism, combining static analysis during development with dynamic runtime checks. This ensures both early detection of potential issues and the ability to evaluate policies dependent on dynamic, runtime-specific data.

1. Efficiency and Coverage through Hybrid Enforcement: The hybrid approach is a significant finding, demonstrating superior performance and coverage compared to purely static or purely runtime solutions. Static checks proactively identify policy violations before deployment, reducing the number of checks required at runtime. Conversely, runtime checks handle policies that require dynamic information, such as specific data values or environmental attributes, thus improving the overall coverage and robustness of the enforcement. This synergy leads to tangible performance benefits.

1. Quantifiable Performance Overheads: Empirical evaluation of Growlithe on real-world serverless applications revealed minimal and acceptable performance overheads:

• Runtime Overhead: Growlithe, with its hybrid enforcement, adds an average of 23 milliseconds overhead per function execution. When relying solely on runtime enforcement, this overhead increased to 28 milliseconds. This indicates a 19% improvement in function runtimes when leveraging the hybrid approach over pure runtime checks.
• Cold Start Overhead: The maximum cold start overhead observed was approximately 180 milliseconds. This overhead, primarily incurred during container initialization, is considered manageable given that cloud providers continuously optimize to reduce cold start occurrences.

1. Scalability Across Workflows: Growlithe's design demonstrates strong scalability across different serverless application topologies:

• Linear Chain Workflows: For applications where n functions execute sequentially, Growlithe's end-to-end latency overhead scales linearly.
• Fan-out Workflows: In scenarios where n functions are invoked in parallel, the overhead scales sub-linearly.

This indicates that Growlithe can effectively manage the compliance needs of growing and complex serverless applications, irrespective of their architectural patterns, which typically fall between these two extremes.

1. Generality, Extensibility, and Effectiveness: While detailed in the accompanying paper, the talk highlights Growlithe's foundational principles of:

• Generality: Its ability to operate across different cloud platforms (AWS, GCP) and programming languages (Python, JavaScript) due to its common abstraction layer.
• Extensibility: The ease with which it can be extended to support new languages, cloud services, and policy types.
• Effectiveness: Its proven ability to adapt to application or policy changes while maintaining minimal overhead, ensuring continuous compliance.

These findings collectively underscore Growlithe's potential to transform how serverless developers approach data protection, moving from reactive, platform-specific solutions to a proactive, integrated, and developer-centric compliance framework.

Technical Deep Dive

▶ Watch: Stage 2: Specifying policies with annotations (4:08)

Growlithe's technical prowess stems from its meticulously designed three-stage process, which transforms raw application code and configurations into a policy-enforced, compliant serverless application. Each stage addresses a critical aspect of integrating compliance into the serverless development lifecycle, from understanding data flow to intelligently enforcing policies.

Stage 1: Data Flow Graph Construction

The initial and foundational stage involves constructing a comprehensive data flow graph for the entire serverless application. The primary goal here is to create a representation that is both language-independent and platform-independent, allowing Growlithe to operate uniformly across heterogeneous serverless environments. This is achieved through a two-step analytical process:

1. Per-Function Analysis:

• Growlithe begins by independently analyzing the source code of each individual serverless function within the application. This analysis is performed using CodeQL, a powerful semantic code analysis engine developed by GitHub. CodeQL allows for querying codebases like databases, enabling precise identification of data interactions.
• For each function, Growlithe generates a per-function graph. These graphs meticulously detail the internal flow of data resources. For example, it can identify operations such as "reading from an S3 object and writing to a local file" or "receiving input from an API Gateway event and pushing it to a DynamoDB table."
• A critical aspect of this step is its ability to handle functions written in different programming languages (e.g., Python, JavaScript). Growlithe achieves this by abstracting the language-specific data flows into a common abstraction layer. This requires a one-time effort to model language-specific libraries and APIs that interact with data resources, but once done, these models can be reused across numerous applications. The current prototype supports Python and JavaScript functions deployed on AWS and GCP.

1. Inter-Function Dependency Integration:

• Once per-function graphs are generated, Growlithe then analyzes the application's cloud configurations. These configurations (e.g., AWS CloudFormation, Serverless Framework YML files, GCP Deployment Manager templates) explicitly or implicitly define how functions interact with each other and with various cloud services.
• By parsing these configurations, Growlithe identifies inter-function dependencies, such as one function invoking another, a function writing to a message queue that triggers another function, or multiple functions accessing the same shared storage service (e.g., S3, relational databases).
• Finally, Growlithe combines these inter-function dependencies with the previously generated per-function graphs to construct a holistic application data flow graph. This comprehensive graph visually represents the end-to-end data flows across the entire serverless application, from initial entry points to final storage or external service interactions. This unified view is indispensable for understanding potential data leakage paths and for defining granular compliance policies.

Stage 2: Policy Specification

With the application data flow graph in hand, the second stage empowers developers to specify their data protection and compliance requirements. This is achieved by annotating the edges of the data flow graph with policies expressed in a declarative specification language. The design of this language aims for intuitiveness and expressiveness, allowing developers to define complex rules without needing deep security expertise.

The policies typically fall into two main categories:

1. Access Control Policies: These policies govern who or what can access data, often based on contextual attributes. They can be dependent on:

• Temporal attributes: E.g., "Data access is allowed only during business hours."
• Geographical attributes: E.g., "Writes to a dynamic bucket are allowed only if the bucket is located in the US-East-1 region." This is crucial for data residency requirements.
• Environmental attributes: E.g., "Access is permitted only from specific IP ranges or within a particular Virtual Private Cloud (VPC)."
• Dynamic attributes: Policies that might depend on the current state of the application or external factors.

1. Information Flow Control Policies: These policies restrict how data can move or be transformed within the application, ensuring that sensitive data does not flow to unauthorized destinations or get processed in an unapproved manner. Examples include:

• "Writes to a dynamic bucket are allowed only if the data being written is derived from the same bucket upstream in the workflow." This prevents unauthorized data exfiltration or mixing of data from different sources.
• "Personally identifiable information (PII) must not be written to an unencrypted log file."
• "Financial data processed by function A must only be passed to function B and not to function C."

The declarative nature of the language allows developers to express these rules concisely, abstracting away the underlying implementation details. While the full details of the specification language are elaborated in the research paper, its core strength lies in enabling precise, graph-based policy definition.

Stage 3: Hybrid Policy Enforcement

The final and arguably most innovative stage is Growlithe's hybrid policy enforcement mechanism. This approach strategically combines the benefits of static analysis (at compile-time/development-time) with dynamic runtime checks, optimizing for both performance and comprehensive coverage.

1. Static Checks:

• During the development and deployment pipeline, Growlithe first performs static policy evaluation against the annotated data flow graph. At this stage, policies that do not require runtime-specific information (e.g., region-based access, fixed data flow paths) can be fully evaluated.
• The outcome of a static check can be one of three:
• Allow: The policy is demonstrably met.
• Deny: The policy is demonstrably violated. In this case, Growlithe flags the failure to the developer immediately, preventing deployment of a non-compliant application. This proactive feedback loop is invaluable for debugging and security.
• Defer for Runtime Check: If a policy requires information that is only available at runtime (e.g., the actual value of a data field, the specific geographic location of an incoming request, or a dynamic bucket name), the policy evaluation is deferred.
• The primary benefit of static checks is the early detection of policy violations, which drastically reduces the attack surface and allows developers to rectify issues before they reach production. It also minimizes the overhead of runtime enforcement by pre-validating as many policies as possible.

1. Runtime Checks:

• For policies that were deferred during static analysis, Growlithe automatically generates an updated application. This involves instrumenting the source code of the relevant serverless functions. Growlithe inserts inline assertions directly into the application's code.
• These assertions are lightweight code snippets that are evaluated dynamically at runtime, just before or after a critical data operation. For example, if a policy dictates that "writes to a dynamic bucket are allowed only if the bucket is in US-East-1," an assertion would be inserted before the write operation to check the bucket's region at the moment of execution.
• Crucially, this approach for runtime checks does not require any changes in the underlying infrastructure or cloud provider services. The enforcement logic is embedded directly within the application's functions, making it highly portable and compatible with standard serverless deployment models.
• The hybrid approach offers two significant advantages: static checks efficiently reduce the number of policies that need to be evaluated at runtime, thereby minimizing performance overheads. Concurrently, runtime checks enable the evaluation of policies that depend on dynamic data, ensuring comprehensive coverage that static analysis alone cannot provide. This combination makes Growlithe both efficient and robust in enforcing complex compliance rules in dynamic serverless environments.

Demo / Proof of Concept

▶ Watch: Stage 3: Hybrid static and runtime policy enforcement (4:40)

While the presentation did not feature a live, interactive demonstration of Growlithe, the research team provided compelling empirical evidence through a rigorous evaluation of the tool's performance and scalability. This evaluation served as the proof of concept, demonstrating Growlithe's practical applicability and efficiency in real-world scenarios.

The evaluation focused on several fronts, with specific attention paid to runtime performance overheads on actual serverless applications and scalability using synthetic microbenchmarks.

For runtime performance overheads, Growlithe was tested against three distinct serverless applications. These applications were selected to represent a variety of common serverless patterns, incorporating different data stores (e.g., S3, DynamoDB), inter-function communication mechanisms (e.g., SQS, direct invocation), and programming languages. The talk specifically highlighted results from an image processing application comprising four interconnected functions, providing a concrete example of a multi-function workflow.

The performance comparison involved three configurations:

1. Baseline Application: The original application deployed with only default IAM policies, serving as the control group.
2. Growlithe with Runtime Enforcement Only: The application instrumented by Growlithe, but with all policy checks deferred to runtime.
3. Growlithe with Hybrid Enforcement: The application leveraging Growlithe's full static and runtime hybrid policy evaluation.

The results clearly showcased the benefits of Growlithe's hybrid approach. The configuration with only runtime enforcement introduced an average overhead of 28 milliseconds per function. In contrast, Growlithe's hybrid enforcement strategy reduced this overhead to an average of 23 milliseconds per function. This represents a notable 19% improvement in function runtimes compared to relying solely on runtime checks, validating the efficiency gains from static analysis.

Furthermore, the evaluation measured cold start overheads for individual functions. The maximum cold start overhead observed was approximately 180 milliseconds. The speakers noted that these overheads are dependent on the complexity and number of application policies and that they offload some computation cost from runtime execution to the container initialization phase. Crucially, they emphasized that such cold start overheads are not considered a major concern in practice, as cloud providers continuously optimize their platforms to minimize the frequency and duration of cold start occurrences.

To assess scalability, Growlithe was tested on two types of synthetic workflows:

1. Linear Chain: A workflow where n functions are executed sequentially, simulating a long-running, multi-step process.
2. Fan-out Configuration: A workflow where n functions are invoked in parallel, mimicking highly concurrent, distributed tasks.

Measurements of end-to-end latency overheads on these workflows demonstrated Growlithe's robust scalability. The overhead remained modest, scaling linearly in the linear chain configuration and sub-linearly in the fan-out configuration. Given that typical real-world serverless workflows usually fall between these two extremes, these results indicate that Growlithe scales effectively as application complexity and size grow, ensuring its viability for large-scale deployments.

The thorough evaluation presented serves as a strong proof of concept, empirically validating Growlithe's design principles and demonstrating its ability to integrate compliance into serverless applications with minimal and acceptable performance impact.

Defensive Implications

▶ Watch: Evaluation: Scalability with synthetic workflows (7:08)

Growlithe offers significant defensive implications for organizations operating serverless applications, directly addressing the challenges posed by the shared responsibility model and the inherent complexities of cloud-native architectures. By integrating compliance at a fundamental level, it empowers both developers and security teams to build and maintain more secure and compliant systems.

Firstly, Growlithe acts as a critical safeguard against misconfigurations and accidental data leaks. The automated construction of a detailed data flow graph provides an unparalleled, holistic view of data movement across the entire application. This visibility allows developers and security auditors to identify potential data paths that might violate policies, which could otherwise remain hidden in complex, distributed systems. By mandating policy annotation on this graph, Growlithe ensures that data protection is explicitly considered for every data interaction, significantly reducing the likelihood of oversight.

Secondly, Growlithe provides fine-grained control that goes far beyond the capabilities of traditional, coarse-grained cloud IAM policies. While IAM can restrict access to an entire S3 bucket, Growlithe allows policies based on dynamic attributes like the region of a bucket, the source of the data, or temporal constraints. This granular control is essential for adhering to stringent regulatory requirements (e.g., GDPR, HIPAA, CCPA) that often demand context-aware data handling. Developers can define policies such as "PII must not be written to an unencrypted log" or "financial data can only be processed by functions in a specific compliance zone," which are practically impossible to enforce effectively with native cloud IAM alone.

Thirdly, the hybrid enforcement mechanism provides a powerful, multi-layered defense. The static checks proactively identify policy violations during the development phase, shifting security left in the software development lifecycle (SDLC). This allows developers to catch and fix non-compliant code before deployment, preventing vulnerabilities from ever reaching production environments. This early detection saves significant time and resources compared to discovering issues through runtime monitoring or post-incident analysis. For policies that require runtime context, the inline assertions ensure continuous enforcement without requiring any changes to the underlying cloud infrastructure, making the defense mechanism robust and transparent to the operational environment.

Fourthly, Growlithe's portability across platforms and languages is a key defensive advantage. In an ecosystem where organizations often use multi-cloud strategies or diverse programming languages within a single application, a unified compliance tool is invaluable. Growlithe's common abstraction layer ensures that data protection policies are applied consistently, regardless of the underlying technology stack, reducing the complexity of managing security in heterogeneous environments. Its extensibility also means it can adapt to new services and compliance requirements as the cloud landscape evolves.

Finally, Growlithe facilitates better adherence to the shared responsibility model. It empowers cloud tenants by providing them with the tools necessary to fulfill their responsibility for security in the cloud. By integrating compliance directly into the serverless development workflow, Growlithe helps organizations build security by design, reducing their reliance on reactive measures and bolstering their overall security posture against data breaches and regulatory non-compliance. It effectively bridges the gap between high-level security policies and their concrete implementation at the application layer.

Key Takeaways

• Addresses Serverless Compliance Gaps: Growlithe provides a critical, developer-centric solution for data protection and compliance in serverless applications, overcoming the limitations of coarse-grained cloud IAM tools and the complexities of heterogeneous, distributed environments.
• Hybrid Enforcement for Efficiency & Coverage: Its innovative hybrid approach, combining static analysis during development with dynamic runtime checks, significantly reduces performance overheads (19% improvement over runtime-only) while ensuring comprehensive policy coverage for both static and dynamic data attributes.
• Developer-Friendly Policy Specification: Growlithe simplifies policy definition by generating language/platform-independent data flow graphs, allowing developers to annotate specific data paths with declarative access control and information flow policies.
• Quantified Performance and Scalability: The tool demonstrates minimal runtime overheads (avg. 23ms per function) and acceptable cold start impacts (max 180ms), with proven linear and sub-linear scalability across various serverless workflow patterns.
• Enhanced Security Posture & Compliance: By integrating compliance into the SDLC, Growlithe enables proactive identification of policy violations, provides fine-grained data control, and ensures continuous enforcement, significantly strengthening an organization's defensive posture and ability to meet regulatory requirements.
• Portable and Extensible Design: Growlithe's architecture supports multiple languages (Python, JavaScript) and cloud platforms (AWS, GCP), and is designed for easy extensibility to new services and evolving compliance needs, making it a future-proof solution for dynamic cloud environments.

About the Speaker(s)

The Growlithe project was presented by Praveen Gupta and developed in collaboration with Arshia Moghimi, Devam Sisodraker, Mohammad Shahrad, and Aastha Mehta. All speakers and collaborators are affiliated with the University of British Columbia (UBC), where this research into serverless security and compliance tools was conducted. Their work focuses on addressing the unique data protection challenges inherent in fast-evolving serverless computing environments.