Learning Serverless Security

Chapter 3. Getting Started with Serverless Security

A Note for Early Release Readers

With Early Release ebooks, you get books in their earliest form—the author’s raw and unedited content as they write—so you can take advantage of these technologies long before the official release of these titles. This will be the 3rd chapter of the final book. Please note that the GitHub repo will be made active later on. If you have comments about how we might improve the content and/or examples in this book, or if you notice missing material within this chapter, please reach out to the editor at [e-mail].

In this chapter, we will have our initial discussion on serverless security. In addition to this, I’ll discuss how Identity and Access Management (IAM) works in the cloud and the concepts are defined and implemented on AWS, Azure, and GCP. Finally, I will dive a bit deeper into the guidelines when performing penetration testing activities inside cloud environments.

Introduction to Serverless Security

In order to understand the scope of serverless security, it is important for us to be aware of the shared responsibility model promoted by the cloud platforms. While there may be a few minor differences in how this is implemented across AWS, Azure, and GCP, the core principles generally remain consistent. For one thing, regardless of the type of deployment and usage of cloud resources, the cloud account owner always is responsible for the data, endpoints, account, and access management ...