Serverless security: how to protect what you don't see?
summary
Serverless shifts operational work into developer hands, so secure choices are enforced with infrastructure as code and cloud APIs, not hand edits. Scale multiplies risk — roughly one microservice ≈ 20 functions — so enforce principle of least privilege with sensible IAM roles, monitor costs to detect abuse, run CI checks (linters, static analysis) on serverless framework/terraform templates, and combine tools like Snyk, GitHub checks and Sqreen to fill monitoring and dependency gaps. WAFs often miss non-HTTP entry points (queues, streams).
AI-written summary · about
chapters (5)
- 0:00Intro
- 2:20What is serverless
- 5:44Impact of serverless
- 9:25Serverless vs microservices
- 13:42What can we do
related talks
33mServerless Security: New Risks Require New Approaches
18mA First Look at the Security of Serverless Applications
30mSecurity in the Serverless Environment
40mServerless Architecture Security Patterns for Securing the Unseen
37mLegends and Myths of Security in Serverless
42mBlowing Up Serverless Security with IAM (And How to Avoid It)
30mServerless Security Top 10
50mAutomated Serverless Security Testing: Delivering secure apps continuously