No Server, No Cry: the Ups and Downs of Building a Scalable Security Serverless Platform

An engineering lead from Jit delivers a guide to architecting secure, production-ready serverless applications in the Cloud Village, addressing the misconceptions surrounding serverless security [00:00]. While cloud providers manage underlying physical infrastructure and OS patching, the speaker clarifies that tenants remain entirely responsible for identity, access controls, code vulnerabilities, secrets management, and runtime logging under the shared responsibility model [02:33].

The presentation maps the OWASP Top 10 vulnerabilities directly onto serverless architectures, detailing mitigations for broken access controls, command injection, and vulnerable third-party dependencies [03:03, 05:31]. The speaker demonstrates automated enforcement strategies, including deploying AWS IAM Access Analyzer to restrict overly permissive Lambda execution roles down to least-privilege policies [08:05, 10:52], configuring Amazon CloudWatch metric alarms to detect anomalous DynamoDB scans [11:16], using open-source tools like Prowler and Checkov for infrastructure-as-code linting [13:36, 14:10], and running Google OSV Scanner to detect outdated dependencies and unmaintained Lambda runtime environments [16:41, 17:33].

(AI summary — Gemini Flash)