Self-service AWS Serverless Application Model
summary
Coinbase builds a SAM-based gate that validates CloudFormation templates, IAM and resource tags before deployment, using a Step Functions workflow and a Lambda runner called Fenrir to enforce permissions boundary policies, require per-lambda security groups and restrict API Gateway and SQS references to same-stage resources. The system returns actionable errors, makes API Gateways private by default, and cut deployment time and friction while keeping least-privilege controls. Motivation cites the IC3 2018 $2.71B fraud figure and large exchange losses.
AI-written summary · about
chapters (7)
- 0:00Introduction and motivation
- 1:13The security and dev balance
- 3:21Automating security via SAM
- 5:55Policy implementation tactics
- 8:51Securing serverless resources
- 11:33IAM roles and policy tricks
- 15:28Fenris and project conclusion
related talks
04mServerless applications, Microservices, AWS
30mBuilding serverless applications with infrastructure as code
33mServerless Security: New Risks Require New Approaches
24mBuilding serverless applications with infrastructure as code
50mStreamline your Cloud Native Application Deployment using AWS SAM
32mThe Serverless Tidal Wave
42mBlowing Up Serverless Security with IAM (And How to Avoid It)
25mBuilding serverless applications with Amazon S3