Serverless Architecture Security Patterns for Securing the Unseen
summary
Shows a live lambdashell.com demo where captured AWS access key secret and session token let an attacker use a Lambda execution role to write CloudWatch logs and spike billing, proving serverless is not inherently safe. Recommends concrete controls: CloudFront/WAF and geo/IP rules at the edge, API Gateway JWT validation, DynamoDB policies scoped to source VPC, KMS-based encryption at rest, and least privilege roles plus automated containment (quarantine to a forensic account) integrated into DevSecOps.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:58Agenda
- 2:58Data Life Cycle
- 5:24Serverless Threat
- 9:11Example
- 13:10Design Principles
- 14:29Zero Trust
- 18:24Key Design Principles
- 18:58Amazon Sample Architecture
- 19:55Frontend Layer
- 21:08Bucket Policy
- 21:38Content Distribution
- 22:14Token Validization
- 23:12JOT Token
- 24:13Database Security
- 26:51Sample Database Policy
- 32:33What are you trying to solve
- 34:14Shared Security Model
related talks
33mServerless Security: New Risks Require New Approaches
30mServerless Security Top 10
30mSecurity in the Serverless Environment
50mAutomated Serverless Security Testing: Delivering secure apps continuously
24mServerless security: how to protect what you don't see?
42mBlowing Up Serverless Security with IAM (And How to Avoid It)
57mServerless Security: Attack and Defense
18mA First Look at the Security of Serverless Applications