Security Design with Lambda
Security in Lambda is primarily about identity and least privilege.
IAM Execution Role
Every Lambda function runs with an IAM role.
Best practice:
- Grant only necessary permissions.
- Avoid wildcard policies.
- Separate roles per function.
Network Security
If Lambda connects to private resources:
- Attach it to a VPC.
- Use security groups.
- Restrict outbound access if necessary.
Be aware: VPC attachment may increase cold start latency.
Secrets Management
Never hardcode secrets.
Use:
- AWS Secrets Manager
- AWS Systems Manager Parameter Store
Architecturally, secret isolation prevents credential leakage and lateral movement.
Event Source Validation
If Lambda is triggered by external input:
- Validate input.
- Sanitize data.
- Use API Gateway authorizers.
Security must be designed, not assumed.
In this section, I learned:
0 of 4 completed