Blowing Up Serverless Security with IAM (And How to Avoid It)
summary
Claims that IAM acts as the real network in serverless and that misconfigurations are the most common cloud breach vector are supported by examples and tooling: Fugue runs on AWS Lambda and uses policy-as-code with Open Policy Agent; Fugue IAC checks templates and runtime; Snyk is recommended for deps. Concrete recommendations include one IAM role per function, automated generation of least‑privilege policies, scrutiny of cross‑account IAM, avoiding VPC placement for Lambdas, and awareness of reuse of Lambda execution environments to prevent cross‑tenant data leaks.
AI-written summary · about
chapters (11)
- 0:00Serverless security & IAM intro
- 3:27Why serverless security needs rethink
- 7:10Shared responsibility model
- 12:33Serverless architecture deep dive
- 23:24Key security recommendations
- 29:47Q&A
- 30:10Resources for learning
- 30:32IAM config mistakes
- 33:50Infrastructure & policy as code
- 36:19Mixing serverless workloads
- 39:13Future of policy as code
related talks
33mServerless Security: New Risks Require New Approaches
24mServerless security: how to protect what you don't see?
37mLocking Down the Security of IAM
40mServerless Architecture Security Patterns for Securing the Unseen
26mWhen Infra IS Code -Operations in a Serverless World
30mServerless Security Top 10
30mSecurity in the Serverless Environment
50mAutomated Serverless Security Testing: Delivering secure apps continuously