Serverless, Edge Workers, Functions and Event-Driven Cloud Security — DedSec Project

Serverless platforms reduce infrastructure management while increasing reliance on IAM, event sources, managed services, deployment packages, and provider isolation. Security work shifts from host hardening toward authority, data flow, event validation, and observability.

Learning objectives

By the end of this module you should be able to:

• Explain Invocation surface and connect it to a concrete trust boundary or security invariant.
• Explain Execution identity and connect it to a concrete trust boundary or security invariant.
• Explain Event trust and connect it to a concrete trust boundary or security invariant.
• Explain Ephemeral runtime and connect it to a concrete trust boundary or security invariant.
• Explain Secrets and connect it to a concrete trust boundary or security invariant.
• Explain Dependency packaging and connect it to a concrete trust boundary or security invariant.

Deep concepts

1. Invocation surface

Functions can be invoked by HTTP, queues, storage events, schedules, database changes, or internal services. Inventory every trigger and the identity/context it supplies.

2. Execution identity

A function’s service role often defines its real blast radius. Apply least privilege per function or narrowly related workload; avoid broad shared roles.

3. Event trust

Cloud events are structured input, not inherently trusted input. Validate resource identity, tenant/account, event type, object path, replay/idempotency, and authorization assumptions.

4. Ephemeral runtime

Instances may be reused even though they are conceptually ephemeral. Do not depend on local process state for security, and avoid leaving sensitive data in temporary storage longer than necessary.

5. Secrets

Use managed secret/workload identity mechanisms and avoid embedding credentials in deployment packages or environment variables when a safer provider mechanism is available.

6. Dependency packaging

A small function can still contain a large dependency tree. Apply provenance, pinning, scanning, and minimal packaging just as for long-running services.

7. Edge execution

Edge workers run closer to users and may have constrained APIs but large request volume. Understand provider-specific isolation, regional data handling, cache behavior, and identity to origin services.

8. Observability and cost abuse

Log trigger identity, request/event IDs, principal, downstream calls, errors, throttling, and cost-related anomalies. Resource-consumption abuse can be a security and financial-availability issue.

Authorized exercises

Exercise 1 — Model one photo-processing function triggered by object storage and identify what prevents another tenant/object path from being processed

Model one photo-processing function triggered by object storage and identify what prevents another tenant/object path from being processed.

Exercise 2 — Write an IAM policy matrix for three functions that each need different storage/database actions

Write an IAM policy matrix for three functions that each need different storage/database actions.

Exercise 3 — Create a replay/idempotency test plan for a harmless event-driven workflow

Create a replay/idempotency test plan for a harmless event-driven workflow.

Knowledge checks

1. Explain the most important trust boundary in Serverless, Edge Workers, Functions and Event-Driven Cloud Security without naming a security tool.
2. Give one example where cryptographic or authentication success still does not imply authorization success.
3. Describe one stale-state or replay condition relevant to this module.
4. Identify one telemetry source that can support a strong conclusion and one blind spot it still leaves.
5. Explain how you would turn a discovered weakness into a regression test rather than a one-time finding.

Guided study workflow