Securing Serverless Functions

Try it out loud first. Then check yourself:

1. The provider patches the servers; you still own the code, its dependencies, its permissions and its configuration.
2. Give each function its own role with only what it needs; a shared, broad role turns one bug into account-wide access.
3. Every trigger is input: queue messages, file uploads and HTTP events can all carry injection payloads.
4. Keep secrets in a secrets manager, set timeouts and concurrency limits, and send logs somewhere you actually watch.

If the interviewer pushes back

• A function has a command injection bug. What can an attacker reach, and how do you limit it?

Go deeper

• docs.aws.amazon.com/lambda/latest/dg/lambda-security.html