Key Takeaways
- 01Serverless eliminates infrastructure management, not security responsibilities — it shifts them. New high-leverage areas are IAM, dependency management, and event-source security.
- 02Function IAM done right: one role per function, permissions scoped to specific resources by ARN (no wildcards), IAM conditions on source IP / VPC / SourceArn wherever the platform supports them, no long-lived AWS keys in env vars — ever.
- 03Validate event-source claims. An S3 notification can be spoofed if your function blindly trusts the bucket name in the event. Use SourceArn IAM conditions and revalidate critical assertions inside function code.
- 04Cold-start observability is the silent gap — logs frequently miss the first invocation. Confirm your runtime emits a startup log that is captured, or you will be debugging cold-start incidents blind.
Serverless platforms eliminate infrastructure management. They do not eliminate security responsibilities — they shift them. The new high-leverage areas are IAM, dependency management, and event-source security.
The serverless attack surface
- 01Function IAM roles — over-privileged by default in many starter templates
- 02Event sources — untrusted input from queues, S3 notifications, API Gateway
- 03Dependencies — third-party libraries pulled at deploy time
- 04Secrets — environment variables vs. dedicated secret stores
- 05Cold-start observability — logs that miss the first invocation
IAM for functions, in the right shape
One role per function. Permissions scoped to specific resources by ARN, not wildcards. Use of IAM conditions (source IP, source VPC, SourceArn for service-linked invocations) wherever the platform supports them. No long-lived AWS keys in environment variables — ever.
Event-source validation
Validate event-source claims. An S3 notification can be spoofed if your function blindly trusts the bucket name in the event. Use SourceArn IAM conditions and revalidate critical assertions inside the function code.
#Serverless#Lambda#FaaS