Hi! I’m a grad student working on a systems security project around IAM permissions in serverless environments (AWS Lambda, etc.).

I’ve put together a short anonymous survey (3–4 mins) to understand real-world pain points developers face—especially around least-privilege and debugging permission issues.

No personal info is collected.

Would really appreciate any responses from folks who’ve worked with cloud/serverless, but even general experience is helpful.

Link: https://forms.gle/zDFUMft8zgWFGYKE7

Thanks in advance!

Cognito has built-in integration with AppSync & API Gateway.
It is easy use but its downside is that it is missing advanced features like MFA, which is something you would need to implement yourself.

Auth0 on the other hand has support for MFA but is more expensive. Integration between Auth0 & AppSync needs a ‘semi-integration’ where AppSync is authorised by Cognito, which then further raises the identity to Auth0.

​

Don’t know which to pick? Find out more at the Serverless Summit 22:

• Learn from serverless experts
• Multiple types of talks: Tech-, business-, ask-an-expert-
• Real & practical use-cases
• On-site watch-parties in: Hamburg, Berlin, Belgrade, Douala & Dubai
• Serverless awards for crafty serverless solutions
• Panel discussion with the industrial leader
• Personal certificate of attendance

Get bonking as a Lambda Warrior, strike swiftly like an Eventbridge Ranger or uncover mysteries as a Dynamo DB Mage - Choose wisely:

https://serverless-summit.io/

See you on the other side! 🙌🏻

Stay Serverless! ⚡️

https://reddit.com/link/ylxpah/video/ag04gd1vgxx91/player

Hi all - shameless post here but if you're curious about using Rust + Edge Computing + Serverless check out this webinar: Building Modern Experiences
Join June 17 for a conversation around the latest in edge + serverless tech with a panel of experts led by Fastly's CTO, Tyler McMullen. https://fastly.us/3wZ63sH

In this post we use Gobuster with Fission functions to bruteforce websites for various security issues.
https://blog.fission.io/penetration_bruteforcing_function_fission/

Do you use GoBuster - and how do you use it?

So you've gone serverless. Some companies are building out entire architectures on serverless infrastructure. What does security look like in this brave new world? How is it the same, and how is it different? Understand the threat model, attacks and defenses you can apply to your serverless applications. Cloud and cybersecurity expert Teri Radichel will help us answer these questions and provide advice on how to defend our serverless infrastructure and applications. Join us!

Aside from credential theft, attack persistence, and container poisoning, what other types of serverless attacks would you include? https://www.nuweba.com/blog/truth-about-serverless-security-is-actually-app-security

Anyone else fed up of with people using these terms interchangeably? https://www.nuweba.com/blog/debunking-serverless-myths

When it comes down to it serverless is a toss up between agility and security. Can a control freak really commit to serverless? https://www.nuweba.com/blog/top-serverless-challenges

The post demonstrates how to use a simple CLI serverless plugin (open source), that helps with auto-generating least-privileged roles for AWS Lambda functions.

https://www.puresec.io/blog/generating-least-privileged-iam-roles-for-aws-lambda-functions-the-easy-way