When Infra IS Code -Operations in a Serverless World
summary
Anecdotes show Lambda timeouts causing one customer’s temp files to leak into another, IAM star permissions enabling privilege escalation to extract an entire database, malicious layers exfiltrating environment secrets, and chains of functions creating runaway billing. Recommendations: use strong input validation, enforce least privilege IAM per function, maintain API inventory and SCA for layers, and add real‑time invoke monitoring (invocations, X‑Ray traces) rather than waiting for cost alerts. Serverless works if orgs adopt shared ops ownership and observability.
AI-written summary · about
chapters (12)
- 0:00Horror story intro
- 2:55Speaker introduction
- 5:04Serverless startup lessons
- 7:32Security horror stories
- 10:46Security in serverless
- 14:19Would I choose serverless again
- 15:26DevOps in serverless world
- 20:09Recruiting challenges
- 21:35Advantages of serverless
- 22:57Final thoughts
- 23:18Q&A on Lambda loops
- 24:22Q&A on cost monitoring
related talks
33mServerless Security: New Risks Require New Approaches
42mBlowing Up Serverless Security with IAM (And How to Avoid It)
24mServerless security: how to protect what you don't see?
15mThe Ops in Serverless
18mA First Look at the Security of Serverless Applications
30mSecurity in the Serverless Environment
46mOWASP SERVERLESS TOP 10
30mServerless Security Top 10